WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin SureCart versions = 4.6.2...

WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin Legal Text Connector of the IT-Recht Kanzlei versions = 1.0.13...

WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions = 1.9.0...

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers subscriptionId without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other...

WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Total Upkeep versions = 1.17.2...

WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetFormBuilder versions = 3.6.4.1...

Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App

Overview Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc. web server for debugging purposes remains enabled CWE-489 - CVE-2026-66403 Missing serv...

CVE-2026-28147

The CVE-2026-28147 entry concerns a Missing Authorization vulnerability in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates). Affected versions are up to 2.0.15; the issue is described as broken/incorrectly configured access control that could allow unauthori...

CVE-2026-28147 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

CVE-2026-68582

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

EUVD-2026-51992

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582

Vikunja up to 2.3.0 contains a broken object level authorization (BOLA) in the task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks. The endpoint loads the requested project view from the URL path without validating the caller’s authorization, allowing a link-share token hol...

S3 Clones in the Neoclouds

S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain...

CVE-2026-10700

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/flowid/filename endpoint does not enforce authentication or authorization checks, allowing unauthenticated...

CVE-2026-10700

Langflow OSS versions 1.0.0–1.8.4 are affected by broken access control in the file handling API, allowing unauthorized access to user files via /api/v1/files/images/{flow_id}/{file_name} (no auth/authorization) and IDOR in /api/v1/files/download/{flow_id}/{file_name} (ownership not validated). I...

CVE-2026-10700 Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/flowid/filename endpoint does not enforce authentication or authorization checks, allowing unauthenticated...

CVE-2026-10700

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/flowid/filename endpoint does not enforce authentication or authorization checks, allowing unauthenticated...