CVE-2026-94384

The Amazon amazon-connect-salesforce-lambda component (versions before 5.26 ) is vulnerable to privilege escalation due to missing authorization in the sfExecuteAWSService function. This allows any IAM principal with lambda:InvokeFunction permissions to perform restricted AWS API operations becau...

CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-75607 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware...

CVE-2026-75607 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware...

CVE-2026-75607

Frigate is an open source network video recorder (NVR). In versions prior to 0.17.2 , the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role , because the nginx authentication subrequest does not prov...

CVE-2026-75607 Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware...

CVE-2026-93344

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkinggetpagecontent AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor...

CVE-2026-93343

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-93342

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingduplicateproduct AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers c...

CVE-2026-93341

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingsendrefund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers...

CVE-2026-95685

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-m...

CVE-2026-93344

MarketKing is a multivendor marketplace plugin for WordPress (WooCommerce-based). Versions before 2.1.72 contain a missing authorization vulnerability in the marketking_get_page_content AJAX action. Any authenticated user with subscriber-level access or higher can bypass authorization by supplyin...

CVE-2026-93344 MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkinggetpagecontent AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor...

EUVD-2026-84401

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkinggetpagecontent AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor...

CVE-2026-93344 MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkinggetpagecontent AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor...

EUVD-2026-84400

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-93343 MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-93343 MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-93343

The MarketKing WordPress plugin (Multivendor Marketplace for WooCommerce) before version 2.1.72 contains a missing authorization flaw in the marketking_admin_vendors_ajax AJAX action. Due to absent capability checks, any authenticated user with subscriber-level access or higher can send a crafted...

CVE-2026-93342

The MarketKing multivendor marketplace plugin for WordPress (WooCommerce) prior to 2.1.72 contains a missing authorization flaw in the marketking_duplicate_product AJAX action. Because ownership verification is bypassed, any authenticated user with subscriber-level or higher privileges can supply...