37247 matches found
CVE-2026-77106
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...
CVE-2026-77106 Cvlaunchd Code Execution
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...
CVE-2026-77106
Cvlaunchd , a component of Commvault , contained a missing authorization flaw in its command execution logic, allowing a low-privileged, network-based attacker (with present attack requirements and high complexity) to execute unauthorized commands. The vulnerability carries a CVSS v4.0 base score...
EUVD-2026-72732
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...
CVE-2026-77106 Cvlaunchd Code Execution
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...
CVE-2026-2520
The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a missing capability check on the updateAddon function in all versions up to and including 27.2 . Authenticated attackers with Subscriber-level access or higher can trigger an update of any plugin whose ...
CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...
CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...
CVE-2026-3174 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...
CVE-2026-3174 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...
CVE-2026-9331
The EDD Product Catalog Feed WordPress plugin by PixelYourSite is affected in all versions up to and including 1.0.2 . The root cause is a missing capability check on the wpeddpcf_delete_feed function, allowing any authenticated user with subscriber-level access or higher to delete arbitrary Word...
CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...
CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...
CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...
CVE-2026-77132
TYPO3 CMS is vulnerable to an information disclosure flaw in the backend localization wizard . Several AJAX routes used by this feature failed to perform authorization checks, allowing authenticated, low-privileged backend users to access information about records and content elements outside the...
CVE-2026-85400 TYPO3 CMS - Missing Authorization in lowlevel commands
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...
CVE-2026-85400
TYPO3 CMS versions 14.2.0 through 14.3.6 are affected by a missing authorization check in its lowlevel configuration commands (configuration:read, configuration:set, configuration:show). Backend administrators without system maintainer privileges could schedule these commands, allowing them to mo...
CVE-2026-85400 TYPO3 CMS - Missing Authorization in lowlevel commands
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...
CVE-2026-85400 TYPO3 CMS - Missing Authorization in lowlevel commands
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...
