Access Control Bypass

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Access Control Bypass in the HTTP/2 asynchronous servlet processing. An attacker can cause requests and responses to be mixed up between users by exploiting...

CVE-2026-112824

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

CVE-2026-112829

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30...

CVE-2026-109700

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

Cisco Unified Communications Manager: Vulnerabilities in Permission Authorization and Access Control

Cisco Unified Communications Manager versions 14, 14SU1, 14SU2, 14SU3, 15, 15SU1, 14SU4, 14SU4a, 15SU1a, 15SU2, 15.0.1.13010-1, 15.0.1.13011-1, 15.0.1.13012-1, 15.0.1.13013-1, 15.0.1.13014-1, 15.0.1.13015-1, 15.0.1.13016-1, 15.0.1.13017-1, 15SU3a, 14SU5, 15SU4, 15SU4a, and 14SU6 have...

WordPress BjornTech Swish for WooCommerce authorization issue vulnerability

WordPress BjornTech Swish for WooCommerce versions 3.7.8 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

Splunk SOAR permission and access control issue vulnerability

Versions of Splunk SOAR prior to 8.7.0 contain a vulnerability related to permission escalation and access control. This vulnerability stems from files or directories accessible to external parties, potentially leading to information disclosure...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability stems from heap reuse after heap deallocation in the RTMP protocol component. Remote attackers can send specially crafted Abort control messages without authentication, causing the bRPC...

Apache Pulsar Manager authorization issue vulnerability

Versions 0.1.0 through 0.4.0 of Apache Pulsar Manager contain an authorization issue vulnerability. This vulnerability arises because creating an initial administrator account requires no authentication, and requests sent via the Pulsar Manager proxy are not subject to such authentication checks...

vLLM Permission Authorization and Access Control Vulnerabilities

Versions of vLLM prior to 0.31.0 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from cache alias issues. Authenticated attackers can exploit these vulnerabilities by providing caller-controlled values such as EXIF ImageID or cachesalt, thereby...

Cisco TelePresence Video Communication Server Expressway: Permissions and access control vulnerabilities

The Cisco TelePresence Video Communication Server Expressway has vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may allow local, low-privilege attackers to escalate their privileges and obtain sensitive...

DigitalME eRoom authorization issue vulnerability

DigitalME eRoom versions 1.7.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

Cisco Emergency Responder Permission Licensing and Access Control Vulnerabilities

The Cisco Emergency Responder has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from improper access control mechanisms, which may lead to unauthorized access, data breaches, or privilege escalation...

WordPress Travelly authorization issue vulnerability

WordPress Travelly versions 2.3.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control levels...

Apache Traffic Server has a vulnerability related to input validation errors.

The Apache Traffic Server versions 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0 have a input validation vulnerability. This vulnerability arises when the source server returns the connection back to the shared pool while it is still waiting for a request body that was not fully...

Cisco Open Source Snort3 Authorization Issue Vulnerability

The Cisco Open Source Snort3 has an authorization issue vulnerability. This vulnerability stems from the lack of authentication in the control channel socket implementation. It may allow authenticated, low-privilege local attackers to execute arbitrary commands as the Snort 3 process user, and to...

Splunk Enterprise permission and access control issue vulnerability

Vulnerabilities related to permission and access control exist in Splunk Enterprise versions from 10.4 up to 10.4.4, from 10.2 up to 10.2.8, from 10.0 up to 10.0.11, and from 9.4 up to 9.4.16. These vulnerabilities stem from improper access control and may lead to unauthorized access...

Splunk SOAR permission and access control issue vulnerability

Versions of Splunk SOAR prior to 8.7.0 contain a permission and access control vulnerability stemming from inadequate protection of alternative paths...

CVE-2026-112834

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

CVE-2026-112823

The WP User Manager WordPress plugin (versions n/a through 2.9.25 ) is vulnerable to a Broken Access Control issue. This Missing Authorization vulnerability (CWE-862) allows an attacker to manipulate user states . While the vulnerability is reachable over the network with low complexity, it requi...