20297 matches found
CVE-2026-63042 Apache InLong: Missing authorization on DataNode management endpoints
Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...
CVE-2026-63040 Apache InLong: Missing authorization in StreamSource forceDelete
Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...
WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ian Ho Shim in WordPress Plugin Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions = 1.7.1...
CVE-2026-76878
A flaw was found in OpenStack Aodh and Watcher. In Aodh, the alarm listing API does not correctly enforce project scope when the allprojects query parameter is present with a false value. A non-admin authenticated user can list alarms belonging to other projects, potentially exposing alarm...
CVE-2026-28163
The New User Approve WordPress plugin (versions ≤ 3.2.8) has a broken access control vulnerability discovered by Austin Ginder. Unauthenticated remote attackers can exploit incorrectly configured access control security levels, achieving low integrity impact (CVSS 5.3 MEDIUM). No patch version or...
CVE-2026-28163 WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...
CVE-2026-28163 WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...
WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin New User Approve versions = 3.2.8...
CVE-2026-74021
Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...
CVE-2026-74019
Unauthenticated Broken Access Control in EPROLO Dropshipping = 2.4.2 versions...
CVE-2026-74020
Unauthenticated Broken Access Control in Koji = 2.2.1 versions...
CVE-2026-74001
Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...
CVE-2026-66647
Subscriber Broken Access Control in Homlisti = 3.1.2 versions...
CVE-2026-66677
Subscriber Broken Authentication in Leyka = 3.32.3 versions...
CVE-2026-66595
Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...
CVE-2025-53999
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...
CVE-2026-74020 WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Koji = 2.2.1 versions...
CVE-2026-74020
CVE-2026-74020 is an unauthenticated Broken Access Control vulnerability in the WordPress Koji theme , affecting versions ≤ 2.2.1 . The flaw allows a remote, unauthenticated attacker to access restricted resources over the network with low complexity, resulting in a high confidentiality impact (C...
