UBUNTU-CVE-2026-17548

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2026-77135

CVE-2026-77135 is an information disclosure vulnerability in the TYPO3 extension femanager . The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another ...

CVE-2026-17548

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2026-17548 Missing authorization for viewing background jobs

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

EUVD-2026-65327

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2026-17548

Checkmk , a network monitoring platform, suffers from a missing authorization flaw that allows an authenticated user who knows the ID of a background job to view that job's status and results. The vulnerability affects versions <2.5.0p12, <2.4.0p36,

CVE-2026-17548 Missing authorization for viewing background jobs

Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results...

CVE-2026-66109

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

EUVD-2026-65308

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

CVE-2026-66109

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

CVE-2026-66109

A missing authorization vulnerability in SKYSEA Client View and SKYMEC IT Manager (Windows) allows a local attacker with low-level credentials to execute arbitrary code with SYSTEM privilege . The CVSS 3.0 base score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No user interacti...

CVE-2026-66109

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...

CVE-2026-78467

...

CVE-2026-78467

...

CVE-2026-78467

CVE-2026-78467 is a reservation duplicate of CVE-2026-78272 and has been rejected by the CNA. The underlying vulnerability affects the Fluent Support Pro plugin for WordPress, specifically a missing capability check on a function in all versions up to and including 2.3.1 . This allows authenticat...

CVE-2026-75930 FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-75930 FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update vulnerability

Missing Authorization to Authenticated Editor+ Limited Option Update vulnerability discovered by Wordfence PRISM in WordPress Plugin LearnPress versions = 4.4.4...