20267 matches found
CVE-2026-38470
A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...
PT-2026-81242
Name of the Vulnerable Software and Affected Versions Industry Directory yellowpages2 affected versions not specified Description The company self-service editing feature fails to perform server-side ownership verification during write operations. While the frontend uses a visibility flag to hide...
PT-2026-81873
Name of the Vulnerable Software and Affected Versions GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 Description Broken access control in the IP lock manager allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts. This is...
PT-2026-81323
Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.6.34 through 4.6.57 Description In the praisonai serve agents command, the system fails to enforce authentication on public agent invocation endpoints even when an API key is provided via the --api-key flag. The create...
CVE-2026-38474
GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...
PT-2026-82036
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context hint in github.com/cloudreve/Cloudreve...
PT-2026-81243
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The frontend topic editing flow fails to perform server-side verification to ensure the requesting visitor owns the topic being modified. An attacker can obtain ...
CVE-2026-38470
A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...
CVE-2026-78266
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-78259
Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...
CVE-2026-27364
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...
CVE-2026-78266
AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...
CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-78259 WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...
CVE-2026-78259
CVE-2026-78259 is an unauthenticated Broken Authentication vulnerability in the WPLegalPages WordPress plugin, affecting versions ≤ 3.7.0 . A remote, unauthenticated attacker can exploit this over the network with low complexity and no user interaction, resulting in low-impact compromises to conf...