CVE-2026-63330

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

WordPress ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More plugin <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Deactivation vulnerability discovered by Que Thanh Tuan in WordPress Plugin ThumbPress versions = 6.2.1...

WordPress wpForo Forum plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover vulnerability

Missing Authorization to Authenticated Subscriber+ Guest Post Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin wpForo Forum versions = 3.1.5...

WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack vulnerability

Missing Authorization to Authenticated Subscriber+ Stripe Account Hijack vulnerability discovered by Wordfence PRISM in WordPress Plugin WP User Manager versions = 2.9.18...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-63330

Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux, is affected by a missing authorization check prior to version 0.25.6 . The api_get_recording_stream function in warpgate-admin/src/api/recordings_detail.rs protects the recording stream WebSocket endpoint with only session aut...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-94495 jshERP through 3.6 Missing Authorization via systemConfig

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing...

CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

EUVD-2026-84044

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-94414

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint. Authenticated users can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation, leading to low integri...

CVE-2026-61745 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-61745 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-61745 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

EUVD-2026-84039

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...