CVE-2026-76238: Incorrect Authorization

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

PT-2026-78274

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

PT-2026-78349

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

PT-2026-78296

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description Insufficient authorization checks in an AJAX action allow unauthenticated users to modify the status of arbitrary appointments. This flaw also enables the triggering of notification emails to the...

PT-2026-78273

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

PT-2026-78272

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

PT-2026-78694

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.6.1 Description An issue exists in the GET /host/db/host/:id/password endpoint within src/backend/database/routes/host.ts where host ownership is not enforced during credential resolution. When an authenticated user...

PT-2026-78393

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...

PT-2026-78825

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

CVE-2026-76237: Authorization Bypass Through User-Controlled Key

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

PT-2026-78280

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

ROS-20260819-73-0017

The vulnerability in MediaWiki is related to the lack of protection for administrative data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-76263: Authorization Bypass Through User-Controlled Key

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

PT-2026-78275

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

PT-2026-78944

Name of the Vulnerable Software and Affected Versions Altair versions prior to 5.2.3 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 5.2.2...

PT-2026-78279

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-73385: Missing Authorization

Unauthenticated Broken Access Control in Outranking Plugin Options = 1.1.3 versions...

PT-2026-78306

Name of the Vulnerable Software and Affected Versions WPS Bidouille versions prior to 1.33.5 Description The plugin lacks proper authorization checks in an AJAX action, which allows any authenticated user, including those with subscriber privileges, to retrieve the email addresses of all register...

PT-2026-78295

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description Insufficient authorization checks in certain AJAX actions allow unauthenticated users to modify the email addresses of any user, including those with administrator privileges. This flaw enables an...

PT-2026-78304

Name of the Vulnerable Software and Affected Versions KiviCare versions prior to 4.5.4 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if the requesting user has the necessary permissions to access a specific media file. This allows authenticated use...