PT-2026-97446

Name of the Vulnerable Software and Affected Versions WSP MCP – AI Agents Connector versions prior to 2.7.1 Description Broken access control allows contributors to perform unauthorized actions within the system. Recommendations Update WSP MCP – AI Agents Connector to version 2.7.1 or later...

PT-2026-97448

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway versions prior to 8.2.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.2.5...

CVE-2026-94080: Missing Authorization

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

CVE-2026-84789: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

PT-2026-97492

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-94079: Missing Authorization

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

PT-2026-97466

Name of the Vulnerable Software and Affected Versions AppMySite versions prior to 3.15.5 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 3.15.4...

CVE-2026-95513: Missing Authorization

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...

CVE-2026-86612: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-94679: Missing Authorization

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

PT-2026-97297

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can modify Change Management report schedule configurations for...

CVE-2026-95527: Missing Authorization

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

PT-2026-97174

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API...

CVE-2026-93529: Missing Authorization

Contributor Broken Access Control in WSP MCP – AI Agents Connector = 2.7.0 versions...

PT-2026-97469

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

CVE-2026-95604: Missing Authorization

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

GHSA-4825-P4XM-PCF2 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with create permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. Th...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...