ROS-20261019-73-0028

The vulnerability in Grafana is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2026-84176: Permissive Cross-domain Policy with Untrusted Domains

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

PT-2026-117341

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

VulnCheck KEV: CVE-2026-57727

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0...

PT-2026-117309

MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli only flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting such as a...

PT-2026-117375

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10...

PT-2026-118050

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission broken access control / privilege-management regression in v2.6.0 in code.vikunja.io/api...

ROS-20261019-73-0024

The vulnerability in Golang is related to insufficient resource control during the existence of the resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261019-73-0088

The vulnerability in Java-17-openJDK is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20261019-73-0090

The vulnerability in Java-25-openJDK is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Linux kernel Resource Control Compromise

The vulnerability of the Linux operating system’s kernel is related to insufficient control over resources during its existence. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-112329: Missing Authorization

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...

CVE-2026-111845: Missing Authorization

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...

PT-2026-117326

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched...

CVE-2026-112104: Missing Authentication for Critical Function

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched...

CVE-2026-110902: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...

CVE-2026-112328: Missing Authorization

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...

CVE-2026-112770: Improper Control of Generation of Code

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-91046: Improper Access Control

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin...

PT-2026-117444

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add new module term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course id, since the handler validates...