226601 matches found
CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...
CVE-2025-53999
The WordPress Altair theme (versions up to 5.2.2) has an unauthenticated broken access control flaw (CVSS 6.5, medium), exploitable remotely without credentials. An attacker can alter or disrupt functionality (low integrity/availability impact) but cannot read sensitive data. No fix version or ex...
EUVD-2025-210757
Unauthenticated Broken Access Control in Altair = 5.2.2 versions...
CVE-2025-15689
The WordPress Capella theme (≤2.5.5) allows unauthenticated remote privilege escalation with no user interaction, rated CVSS 9.8 critical. No root cause, patch version, or exploit details are provided in the documents; see the Patchstack advisory for further information. Exploitation status is no...
EUVD-2026-63328
Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...
CVE-2026-74021 WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...
CVE-2026-74021
WordPress Chaplin theme ≤2.6.8 has an unauthenticated broken access control flaw, allowing remote attackers to access restricted content (CVSS 7.5 HIGH, network/low-complexity, no auth). No patch version or exploit details are provided; update to a newer theme version when available.
Why "Shady AI" is Security's Next Big Governance Problem
In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it. The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI...
CVE-2026-77026
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...
CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...
CVE-2026-77026
Convert Forms (by tassos.gr) for Joomla , versions below 5.2.5 , is affected by a client-controlled validation bypass. The front-end Submissions view did not enforce access control, allowing an unauthenticated visitor to list a form's submissions. The CVSS 4.0 base score is 6.9 (MEDIUM) , with a ...
EUVD-2026-63242
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...
CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...
CVE-2026-14949 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...
WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability
Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...
WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hivesec in WordPress Plugin EPROLO Dropshipping versions = 2.4.2...
CVE-2026-76334
creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:32+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
CVE-2026-76321
creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:02+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
CVE-2026-2092 vulnerabilities
Vulnerabilities for packages: keycloak...
EUVD-2026-62961
In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...