278306 matches found
tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might...
GHSA-G74Q-6G2F-874X Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...
NPM: Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
NPM: Tina: Broken Access Control letting any TinaCloud user authorize against any self-hosted site vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions = 15.0.0...
kernel: selinux: check connect-related permissions on TCP Fast Open
A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network...
CVE-2026-78528
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-74017
Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...
CVE-2026-74002
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
CVE-2026-74000
Contributor Broken Access Control in Simple Membership = 4.8.2 versions...
CVE-2026-66676
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...
Azure Logic Apps Elevation of Privilege Vulnerability
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...
@aliceo2/control (>=2.0.2, <=2.1.0), @firestore-emulator/jest (>=0.3.6, <=0.3.15) +42 more potentially affected by CVE-2026-89418 via google-protobuf (>=4.0.0-rc.2, <=4.0.2)
google-protobuf NPM version =4.0.0-rc.2, =2.0.2, =0.3.6, =0.3.6, =0.3.6, =1.56.0, =5.5.3, =7.1.3, =5.4.2, =2.0.2, =8.7.1, =1.0.0, =1.0.0, =1.0.0, =2.3.14 and more Source cves: CVE-2026-89418 Source advisory: MEND:CVE-2026-89418...
CVE-2026-78528 WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
EUVD-2026-81520
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-78528 WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-78528
CVE-2026-78528 affects the WordPress plugin BerqWP in versions 4.1.15 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, discovered by z3r0s , meaning any remote user can exploit it without prior authentication. The CVSS 3.1 score is 5.3 (MEDIUM) , with a vector of ...
CVE-2026-74017
WordPress User Registration plugin versions ≤ 5.2.7 contain an unauthenticated Broken Access Control vulnerability. The flaw allows a remote attacker with no prior privileges to access data they should not, resulting in a low confidentiality impact with no impact on integrity or availability. The...
CVE-2026-74017 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...