PYSEC-2026-4041 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

aimmo (0.1.1a0.post0.dev59), seed-control-interface (>=0.9.0, <=0.9.15) potentially affected by CVE-2026-15307 via django (1.9.12)

django PYPI version 1.9.12 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo 0.1.1a0.post0.dev59 - seed-control-interface =0.9.0, =0.9.15 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2026-15307 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

docker-compose-control-center (>=3.1.1, <=3.1.2) potentially affected by CVE-2026-15307 via django (2.1.11)

django PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =3.1.1, =3.1.2 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

docker-compose-control-center (3.1.0) potentially affected by CVE-2026-15307 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

Improper Output Neutralization for Logs

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-97277

Subscriber Broken Access Control in Social Boost = 3.6.2 versions...

CVE-2026-97297

Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...

CVE-2026-97281

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-97280

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...

CVE-2026-97258

Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...

CVE-2026-62073

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

CVE-2026-97280

The Review Schema WordPress plugin (version 3.1.0 ) is vulnerable to a Missing Authorization flaw (CWE-862). This Broken Access Control vulnerability allows an attacker to exploit incorrectly configured access control security levels . The vulnerability impacts the integrity and availability of t...

CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...

CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...

EUVD-2026-90873

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...