CVE-2026-76455 Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

EUVD-2026-94460

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...

EUVD-2026-94384

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205

Versions of LMCache through 0.5.5 are vulnerable to a missing authentication flaw in the multiprocess coordinator. The vulnerability allows remote unauthenticated attackers to access the HTTP fleet control API, which listens on all interfaces by default. Exploitation of these endpoints enables at...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-105267

A flaw was found in Gitea. The web endpoint used for deleting repository tags shares request handling logic with release deletion without verifying if the target is an ordinary tag. An authenticated collaborator with code write permissions can exploit this flaw to bypass release access controls a...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update

Red Hat JBoss Web Server 7.0.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme DK versions = 3.2.1...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update

Red Hat JBoss Web Server 7.0.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand News versions = 3.4...

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by she11f in WordPress Plugin Barcode Scanner with Inventory & Order Manager versions = 1.13.1...

WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Theme Th Shop Mania versions = 1.9.1...

Improper Access Control

Payload is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of the access.update restriction, which allows an attacker with appropriate access to bypass the restriction and modify a user's password...

CVE-2026-27434

Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2...