454 matches found
CVE-2026-76600 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...
CVE-2026-76600 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...
CVE-2026-76600
Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are affected by an unauthenticated comment deletion vulnerability. The DeleteComment endpoint performed no access checks, allowing any unauthenticated network attacker to delete any comment. The CVSS 4.0 base score is 6.9 (MEDIUM...
EUVD-2026-64321
Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...
CVE-2026-76609 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...
CVE-2026-76608
Fabrik is a Joomla extension that provides form and database functionality. In versions prior to 4.7.2 , the onGetEmail endpoint lacked any access control checks, allowing an unauthenticated attacker to disclose the email address of any commenter. This constitutes an information disclosure vulner...
CVE-2026-76601 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...
EUVD-2026-64315
Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...
CVE-2026-76601
Fabrik is a Joomla extension developed by fabrikar.com. In versions prior to 4.7.2 , the order plugin did not perform any access checks, allowing unauthenticated row reordering of data. An attacker can exploit this over the network without credentials or user interaction to alter the ordering of ...
PT-2026-79584
Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the 'onGetEmail' endpoint does not perform necessary access checks, allowing an unauthenticated user to disclose the email address of any commenter. Recommendations Update to...
CVE-2026-58416
A flaw was found in Gitea. The Fork-PR Actions task, which handles pull requests from forked repositories, can be exploited to read data from a third private repository. This occurs due to a missing guard that should prevent unauthorized access via the collaborative-owner branch. A remote attacke...
CVE-2026-54624
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...
CVE-2026-54741
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with...
CVE-2026-62666
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...
AZL-96770 CVE-2026-65959 affecting package vitess for versions less than 19.0.4-13
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...
CVE-2026-75109 Determined Missing Authorization Check on Generic Task Endpoints
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own...
MINI-CJRV-F3R7-JQV3
Bulletin has no description...
PT-2026-76807
Name of the Vulnerable Software and Affected Versions OpenViking affected versions not specified Description The debug vector scroll and count endpoints apply only account-level scoping and lack user-level access controls. This allows authenticated users to read all co-tenant records, enabling th...