264129 matches found
WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dcs in WordPress Plugin Salevo versions = 1.3.0...
CVE-2026-78122-POC
CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...
enforcement-coverage
Enforcement Coverage Finds API routes that carry a weaker authorization control than their siblings. It found CVE-2026-45316 in Open WebUI from source alone, with no advisory knowledge: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3 comparable write operations on note require hasaccesswrite...
CVE-2026-109329
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to membersassignment.php with a foreign role UUID to gain privileged...
CVE-2026-109285
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
CVE-2026-108477
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...
CVE-2026-108476
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13...
CVE-2026-108475
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6...
CVE-2026-108486
The Forminator plugin for WordPress (versions
EUVD-2026-97722
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0...
CVE-2026-108486 WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0...
EUVD-2026-97721
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...
CVE-2026-107418 WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...
CVE-2026-107418
The Booktics WordPress plugin (versions ≤ 1.0.28 ) is vulnerable to a Broken Access Control issue. This vulnerability stems from Missing Authorization , which allows attackers to exploit Incorrectly Configured Access Control Security Levels . The impact involves unauthorized access to functionali...
WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Andrei in WordPress Plugin Forminator versions = 1.58.0...
WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dzeusking in WordPress Plugin Booktics versions = 1.0.28...
EUVD-2026-97577
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6...
CVE-2026-108475
The VideoWhisper.com Broadcast Live Video WordPress plugin (versions
CVE-2026-108475 WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6...
EUVD-2026-97576
Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13...