PT-2026-71417

CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control...

PT-2026-71415

CWE-284: Improper Access Control...

PT-2026-71411

CWE-284: Improper Access Control...

CVE-2026-58417: Improper Access Control

REST API exposes organization membership of private organizations to public...

CVE-2026-56750: Improper Access Control

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-55986: Improper Access Control

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-59507: Use of Hard-coded Credentials

: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solution...

CVE-2026-59505: Improper Access Control

: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-59501: Improper Access Control

: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-13328: Improper Access Control

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

CVE-2026-73626: Improper Access Control

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-56654: Improper Access Control

Privilege Escalation via Access Token Scope Escalation in API...

CVE-2026-58440: Improper Access Control

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-59763: Improper Access Control

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-58420: Improper Access Control

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58429: Improper Access Control

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

CVE-2026-58437: Improper Access Control

Repository Visibility Manipulation via Git Push Options...

CVE-2026-58507: Improper Access Control

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-59916

Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...

CVE-2026-59917

Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...