PT-2026-84599

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV install themes func function registered on the wp ajax DPDEV install themes action. This makes it...

Linux Distros Unpatched Vulnerability : CVE-2026-84328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web...

CVE-2026-84657: Missing Authorization

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

PT-2026-84624

The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and...

CVE-2026-17563: Missing Authorization

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...

PT-2026-84711

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

PT-2026-84817

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set course mode price at lms/djangoapps/instructor/views/instructor dashboard.py:430 is decorated only with @login required and performs no course-level permission chec...

PT-2026-84628

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...

CVE-2026-84653: Missing Authorization

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

CVE-2026-84794: Missing Authorization

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset...

CVE-2026-78601: Missing Authorization

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...

PT-2026-84720

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...

PT-2026-84673

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

PT-2026-84632

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.46 Description An authorization check is missing before returning student learning statistics, which allows unauthenticated attackers to disclose course counts, points, certificates, and...

CVE-2026-84328

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-84607

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

CVE-2026-53635: Missing Authorization

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

PT-2026-84706

Name of the Vulnerable Software and Affected Versions Rentsyst versions prior to 2.1.3 Description A missing authorization issue allows the exploitation of incorrectly configured access control security levels. Recommendations Update Rentsyst to a version newer than 2.1.2...

CVE-2026-84660: Missing Authorization

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84798: Missing Authorization

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...