72561 matches found
CVE-2026-78084: Improper Access Control
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
CVE-2026-19436: Improper Access Control
The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid...
CVE-2026-85545: Improper Access Control
There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...
CVE-2026-88864: Improper Access Control
Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...
CVE-2026-79725: Improper Access Control
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...
CVE-2026-81941: Improper Access Control
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...
PT-2026-89618
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description Improper access control allows a remote authenticated attacker to read arbitrary files from the system. Recommendations Update IBM Langflow OSS to a version later than 1.11.5...
CVE-2026-50165
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...
CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...
CVE-2026-50165
alf.io , an open-source ticket reservation system, contains an Improper Access Control flaw in its organization and event "single configuration" endpoints. These endpoints require only organization or event ownership but accept an arbitrary configuration key, performing a lookup that includes sys...
EUVD-2026-75140
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...
CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...
CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...
CVE-2026-79617
CVE-2026-79617 is an improper access control vulnerability (Incorrect Permission Assignment for Critical Resource) in TÜBİTAK BİLGEM's Pardus LightDM Greeter , affecting versions before 0.4.15 . The flaw allows an attacker with local access and low privileges to exploit incorrectly configured acc...
CVE-2026-79617 Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Greeter: before 0.4.15...
Vulnerabilities in Adobe ColdFusion
Adobe has identified several vulnerabilities in Adobe ColdFusion. These vulnerabilities include a stored Cross-Site Scripting XSS vulnerability, where an attacker with low privileges can inject malicious scripts into form fields, which are then executed in the user’s browser. There is also a...
CVE-2026-21109
Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...
CVE-2026-21098
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction...