CVE-2026-13607: Improper Access Control

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-103085: Improper Access Control

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-104974: Improper Access Control

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...

PT-2026-106071

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

PT-2026-104734

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local"...

CVE-2026-100727: Files or Directories Accessible to External Parties

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local"...

Linux Distros Unpatched Vulnerability : CVE-2026-102795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

DEBIAN-CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

UBUNTU-CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

EUVD-2026-91766

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Apache Traffic Server is affected by an Improper Access Control vulnerability due to the SNI to Host header matching policy not being properly enforced. This issue impacts versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 . To remediate this vulnerability, users are recommended to upgrade t...

CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-104914

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes e.g., via the deleted-attributes search or the paginated attribute listing, the application returned soft-deleted attributes...

EUVD-2026-91717

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes e.g., via the deleted-attributes search or the paginated attribute listing, the application returned soft-deleted attributes...

CVE-2026-104914

MISP versions prior to v2.5.48 are vulnerable to an improper access control vulnerability in its attribute search and paginated attribute view endpoints. The root cause is a lack of visibility restrictions in these specific code paths; while the event detail view correctly restricts soft-deleted ...