PT-2026-106334

Unauthenticated Broken Access Control in WP Event Solution = 4.1.25 versions...

PT-2026-106417

Name of the Vulnerable Software and Affected Versions Wise Chat versions prior to 3.4.3 Description An authorization flaw exists due to incorrectly configured access control security levels, which allows for broken access control for subscribers. Recommendations Update to version 3.4.3 or later...

PT-2026-106435

Name of the Vulnerable Software and Affected Versions Autoship Cloud for WooCommerce Subscription Products versions prior to 2.17.2 Description An issue exists in the autoship-cloud plugin where missing authorization allows the exploitation of incorrectly configured access control security levels...

PT-2026-106425

Name of the Vulnerable Software and Affected Versions PayPlug for WooCommerce Official versions prior to 3.1.1 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update PayPlug for WooCommerce Official to...

PT-2026-106423

Name of the Vulnerable Software and Affected Versions App for Cloudflare® versions prior to 1.10.2 Description Broken access control exists for subscribers within the application, which may allow unauthorized access to restricted resources or functionality. Recommendations Update to a version new...

PT-2026-107265

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.54.6 Description Scaffolder source-control actions may not consistently enforce intended credential boundaries. This allows an authenticated user to cause an affected action to fall back to broader integration...

CVE-2026-106586: Always-Incorrect Control Flow Implementation

In sshd in OpenSSH before 10.6, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283...

ROS-20261006-73-0067

The vulnerability in the kernel-lt is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2026-104387: Missing Authorization

Unauthenticated Broken Access Control in PowerPress Podcasting = 11.17.9 versions...

CVE-2026-62072: Missing Authorization

Subscriber Broken Access Control in Progress Planner = 1.10.0 versions...

CVE-2026-97300: Improper Control of Interaction Frequency

Unauthenticated Broken Access Control in WP Event Solution = 4.1.25 versions...

PT-2026-106385

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

CVE-2026-79797: Improper Access Control

An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote attacker, with user interaction, to...

CVE-2026-105059: Missing Authorization

Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1...

ROS-20261006-73-0189

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0205

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0130

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106369

Subscriber Broken Access Control in WPO365 = 44.1 versions...

CVE-2026-32582: Missing Authorization

Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0...

CVE-2026-104033: Off-by-one Error

A flaw was found in SSSD. When configured to enforce account expiration using LDAP Lightweight Directory Access Protocol shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass...