277752 matches found
PT-2026-117387
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...
PT-2026-117622
Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.7 Craft CMS versions 5.0.0 through 5.10.9 Description A Twig sandbox allowlist bypass exists because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys vi...
CVE-2026-112178: Missing Authorization
MISP contains an access control flaw in the proposal shadow attribute visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own...
PT-2026-117340
Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...
CVE-2026-83531: Improper Control of Generation of Code
Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...
CVE-2026-111831: Missing Authorization
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...
PT-2026-117397
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...
PT-2026-117476
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...
PhantomTac: Hijacking Robotic Tactile Systems with Deploy-And-Forget Tags
Tactile perception is crucial for precise robotic manipulation, providing an important foundation for dexterous, closed-loop force control. Among various tactile sensing techniques, magnetic tactile sensors stand out thanks to their fine-grained, three-dimensional force perception capability and...
Linux kernel DoS
The vulnerability in the drivers/hwmon/occ/common.c component of the Linux kernel kernel is related to an improper implementation of a control flow. Exploitation of this vulnerability may allow an attacker to cause a denial of service...
PT-2026-117381
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...
PT-2026-117651
Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The OSDP Control Panel reply parser cp decode response in subsys/mgmt/osdp/src/osdp cp.c fails to properly validate the payload length for REPLY KEYPPAD and REPLY RAW reply types. An attacker...
PT-2026-117405
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744...
CVE-2026-106014: Improper Access Control
The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying...
CVE-2026-111839: Missing Authorization
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7...
ROS-20261019-73-0076
The vulnerability in Java-21-openjdk is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
ROS-20261019-73-0075
The vulnerability in Java-17-openJDK is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
ROS-20261019-73-0073
The vulnerability in Java 1.8.0-openjdk is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...