CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112292

Versions of CheckCle through 1.6.0 are vulnerable to a missing authorization vulnerability (CWE-862) because the shipped PocketBase collections use empty API rules. This flaw allows unauthenticated attackers to query /api/collections//records endpoints to read, modify, or delete records. Potentia...

EUVD-2026-104280

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112262 RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

EUVD-2026-104311

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

CVE-2026-112262

RisingWave versions before 3.1.0 are susceptible to a missing authorization vulnerability (CWE-862) involving posix_fs and fs connectors . Attackers with schema CREATE privileges can exploit this by setting posix_fs.root or fs.path to arbitrary directories. This allows low-privileged SQL users to...

CVE-2026-111938

Frappe CRM versions prior to 1.74.0 are vulnerable to a missing authorization vulnerability (CWE-862). Authenticated Sales Users can modify the call logs of other users by providing arbitrary call_sid values. Specifically, an attacker can access the add_note_to_call_log and add_task_to_call_log e...

CVE-2026-111938 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...

EUVD-2026-104313

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...

CVE-2026-111937 Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on touser or call markasread with another user argume...

CVE-2026-111937

Frappe CRM versions prior to 1.81.2 are vulnerable to a missing authorization flaw (CWE-862) within the CRM Notification records . Due to the absence of necessary permission hooks, authenticated Sales Users can bypass intended access controls. Specifically, an attacker can query frappe.client end...

EUVD-2026-104314

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on touser or call markasread with another user argume...

CVE-2026-111831

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...

CVE-2026-111845

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...

CVE-2026-111836

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0...

CVE-2026-111839

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7...

CVE-2026-110363

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Unauthenticated Media Upload Description The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. Usage: usage:...

EUVD-2026-104260

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...

EUVD-2026-104258

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...