CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

EUVD-2026-66407

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-3235

The WP Data Access plugin for WordPress is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) in all versions up to and including 5.5.68 . The flaw resides in the check_app_access function, where a mismatch between the authorization check (performed against app_id) and the d...

CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

WordPress WP Data Access plugin <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access vulnerability

Unauthenticated Insecure Direct Object Reference to Data Access vulnerability discovered by type5afe in WordPress Plugin WP Data Access versions = 5.5.68...

PT-2026-82267

Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to gaining access to unauthorized data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093625)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093625 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 5.7.33 and prior and 8.0.23...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093283 advisory. Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Plug-in. Supported versions that are affected are 5.7.26 and prior and 8.0.16...

CVE-2026-79940: Improper Access Control

Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to gaining access to unauthorized data...

IBM Java 7.1 < 7.1.5.32 / 8.0 < 8.0.8.71 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.32 / 8.0 prior to 8.0.8.71. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle August 18 2026 CSPU advisory. - Vulnerability in Oracle Java SE component: 2D. Supported versions that are...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-061546)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061546 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Logging. Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior...

CVE-2026-66003: Incorrect Authorization

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...

PT-2026-82082

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check app access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-3235: Authorization Bypass Through User-Controlled Key

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

USN-8677-1: OpenJDK 21 vulnerabilities

It was discovered that the JSSE component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attack...

USN-8677-1 openjdk-21 vulnerabilities

It was discovered that the JSSE component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attack...

USN-8676-1: OpenJDK 17 vulnerabilities

It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attack...

USN-8674-1: OpenJDK 11 vulnerabilities

It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attack...

Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerability, tracked as...

CVE-2026-56094: Improper Neutralization of Special Elements in Data Query Logic

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...