CVE-2026-93596: Missing Authorization

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine = 26.8.1 fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/database. Because those workers have no current user,...

CVE-2026-82885: Missing Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API...

PT-2026-95606

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.5 and 9.0 Description Missing authorization checks in the administrative console may allow a remote attacker to obtain sensitive information. Recommendations At the moment, there is no information...

CVE-2026-61550: Missing Authorization

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

PT-2026-95254

Name of the Vulnerable Software and Affected Versions Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5 Description An authorization check is missing in an appointment-retrieval action. This allows users with a low-privilege role specific to the plugin to access...

CVE-2026-16750

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...

CVE-2026-54643 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-54643 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-54643

CubeCart prior to version 6.7.5 is affected by a missing authorization check in the delete-note handler (admin/sources/orders.index.inc.php). The handler verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring the CC_P...

CVE-2026-54643 CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-54648

CubeCart (an ecommerce platform) is vulnerable to unauthorized customer data deletion in versions prior to 6.7.5 . The GDPR tools in admin/sources/customers.gdpr.inc.php rely only on page-level CC_PERM_READ access and fail to enforce CC_PERM_DELETE for the purge, no_order_purge, and delete_guests...

CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-14311 Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

CVE-2026-14311 Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to unauthenticated payment bypass in versions up to and including 2.4.5 . The root cause is that the plugin accepts a client-supplied package-redemption identifier as proof of payment without properly validat...

CVE-2026-16750 Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...

CVE-2026-16750

The Motors – Car Dealership & Classified Listings WordPress plugin is vulnerable to unauthorized data access due to missing authorization checks in the mvl_ajax_dealer_load_cars() function, affecting all versions up to and including 1.4.120 . An unauthenticated attacker can exploit this to retrie...

CVE-2026-16750 Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...