278221 matches found
CVE-2026-95604: Missing Authorization
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-94079: Missing Authorization
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
CVE-2026-6718: Incorrect Default Permissions
IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...
PT-2026-97531
Name of the Vulnerable Software and Affected Versions Mesop versions prior to 1.3.4 Description The unauthenticated '/ csp ' endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp report function in mesop/server/static file serving.py. These values...
PT-2026-97674
Name of the Vulnerable Software and Affected Versions Drupal Mermaid Diagram Field versions 1.0.4 through 1.0.9 Description An incorrect authorization issue allows forceful browsing. The module fails to properly limit access to modal content and does not sufficiently respect default revision...
CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...
CVE-2026-84719: Missing Authorization
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...
CVE-2026-77765: Improper Access Control
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...
PT-2026-97480
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
PT-2026-97446
Name of the Vulnerable Software and Affected Versions WSP MCP – AI Agents Connector versions prior to 2.7.1 Description Broken access control allows contributors to perform unauthorized actions within the system. Recommendations Update WSP MCP – AI Agents Connector to version 2.7.1 or later...
CVE-2026-93529: Missing Authorization
Contributor Broken Access Control in WSP MCP – AI Agents Connector = 2.7.0 versions...
PT-2026-97455
Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...
PT-2026-97466
Name of the Vulnerable Software and Affected Versions AppMySite versions prior to 3.15.5 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 3.15.4...
Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...
PT-2026-97473
Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a...
CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...
PT-2026-97174
Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API...
PT-2026-97454
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
CVE-2026-84789: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...