CVE-2026-109890

The Premium Addons for Elementor WordPress plugin (versions up to and including 4.11.110 ) is vulnerable to a Broken Access Control issue (CWE-862). The root cause is Missing Authorization , which allows for exploiting incorrectly configured access control security levels. This vulnerability carr...

CVE-2026-109890 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...

CVE-2026-109890 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...

WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mash in WordPress Plugin Download Monitor integration for WooCommerce versions = 1.0.3...

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mohammed Dsleman in WordPress Plugin Premium Addons for Elementor versions = 4.11.110...

CVE-2024-34320

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints...

CVE-2026-106042

Ivanti Xtraction versions before 2026.4 are affected by an External Control of File Name or Path vulnerability (CWE-73). This flaw allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint. Successful exploitation enables the attacker to ...

CVE-2026-106042

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...

EUVD-2026-98848

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...

CVE-2026-106042

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...

WordPress WP OAuth Server Authorization Issue Vulnerability

WordPress WP OAuth Server versions 6.4.0 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization, which may allow attackers to exploit incorrectly configured access control levels...

WordPress Push Notification for Posts and BuddyPress: Authorization Issues Vulnerability

WordPress push notification for posts and BuddyPress versions 3.23 and earlier have a permission-related vulnerability. This vulnerability stems from the absence of proper permissions, which may allow attackers to exploit incorrectly configured access control levels...

Kedacore KEDA: Permissions management and access control vulnerabilities

KEDACORE KEDA 2.20.2 and earlier versions have security vulnerabilities. This vulnerability arises from the ability of the namespace administrator to create TriggerAuthentication and ScaledObject resources, thereby setting hashiCorpVault.address as a tenant-controlled endpoint. By selecting...

M A Vinoth Kumar Frontend Dashboard: Permissions, Licenses, and Access Control Vulnerabilities

The M A Vinoth Kumar Frontend Dashboard 3.0.7 and earlier versions have vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-102250

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the affected software. This flaw could allow an attacker to upload modified firmware when an authorized administrator initiates a firmware update procedure. Successful exploitation could result in an attacker gainin...

EUVD-2026-98779

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-109959

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...