37525 matches found
CVE-2026-77966
CVE-2026-77966 affects the Ebyte NA111-M , a CISA ICS-listed product, where missing authorization fails to separate limited and administrative management functions. A low-privileged authenticated attacker can access security-sensitive configuration functions and modify settings that impact the de...
CVE-2026-78076
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...
CVE-2026-19616
Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2...
CVE-2026-78076 Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...
EUVD-2026-68528
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...
CVE-2026-78076
Helix Ultimate (joomshaper.com), a Joomla template/extension, is affected in versions below 2.2.10 . The vulnerability is a Broken Access Control issue in the MegaMenu Settings feature: the AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edi...
CVE-2026-78076 Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...
EUVD-2026-68521
Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2...
CVE-2026-19616 Information Disclosure in TBC Technology's KitLogistic
Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2...
CVE-2026-19616 Information Disclosure in TBC Technology's KitLogistic
Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2...
CVE-2026-19616
CVE-2026-19616 is a Missing Authorization vulnerability in TBC Technology Inc. KitLogistic prior to v2.2.2 . The flaw allows an attacker to access functionality not properly constrained by ACLs , meaning unauthorized network-based access to restricted features is possible without credentials or u...
CVE-2026-74010
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...
CVE-2026-74010
bbPress (WordPress plugin by John James Jacoby) versions up to and including 2.6.14 contain a Missing Authorization (Broken Access Control) vulnerability that allows exploitation of incorrectly configured access control security levels. The CVSS 3.1 score is 5.3 (MEDIUM) with a network vector, no...
EUVD-2026-68504
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...
CVE-2026-74010 WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...
CVE-2026-74010 WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...
CVE-2026-82878 DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard...
CVE-2026-82871 ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...
CVE-2026-82882: Missing Authorization
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...