CVE-2026-74010

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

CVE-2026-74010 WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

EUVD-2026-68504

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

CVE-2026-74010

bbPress (WordPress plugin by John James Jacoby) versions up to and including 2.6.14 contain a Missing Authorization (Broken Access Control) vulnerability that allows exploitation of incorrectly configured access control security levels. The CVSS 3.1 score is 5.3 (MEDIUM) with a network vector, no...

CVE-2026-74010 WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

CVE-2026-82878 DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard...

CVE-2026-82871 ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

PT-2026-83799

Name of the Vulnerable Software and Affected Versions bbPress versions prior to 2.6.15 Description A missing authorization issue exists that allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version 2.6.15 or later...

PT-2026-84042

Name of the Vulnerable Software and Affected Versions Devtron versions prior to 2.2.1 Description Insufficient authorization checks on the 'GET /orchestrator/api-token/webhook' endpoint allow authenticated users to retrieve admin API tokens. By providing arbitrary project, environment, and...

PT-2026-83809

Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2...

CVE-2026-82871: Missing Authorization

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

CVE-2026-77966: Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-79745: Missing Authorization

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-79744: Improper Privilege Management

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...

CVE-2026-82394: Missing Authorization

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in...

CVE-2026-74010: Missing Authorization

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

CVE-2026-81762: Missing Authorization

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81758: Missing Authorization

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-81278: Missing Authorization

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-71415: Missing Authorization

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...