WordPress AcyMailing plugin <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update vulnerability

Authenticated Subscriber+ Missing Authorization to Account Takeover via Notification Template Update vulnerability discovered by d.v4ns3c in WordPress Plugin AcyMailing SMTP Newsletter versions = 10.11.1...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72536

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...

CVE-2026-72535

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

CVE-2026-68088

A flaw was found in the Linux kernel's RNDIS Remote Network Driver Interface Specification gadget function. A missing length check for BufLength and BufOffset parameters within the rndisqueryresponse function could allow a malicious actor to provide specially crafted input. This could lead to...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

The CVE-2026-72605 entry concerns Swing Music 3.0.0 with a missing authentication flaw: the POST /auth/profile/create endpoint is allowlisted from JWT verification, enabling unauthenticated remote attackers to create arbitrary user accounts. This can lead to attackers registering accounts and gai...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72548

OpenSignLabs OpenSign (up to version 2.37.0) contains an information disclosure vulnerability in the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication/authorization checks, enabling unauthenticated remote attackers...

CVE-2026-72542 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72542

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72542 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72541

The CVE-2026-72541 entry concerns Windmill Labs Windmill (through v1.783.0) where a missing authorization flaw in the update_resource_type endpoint lets any authenticated workspace member overwrite resource type schemas. The root cause is the endpoint omitting the administrator permission check e...

EUVD-2026-56011

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

CVE-2026-72541 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

CVE-2026-72541 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

EUVD-2026-56006

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...

CVE-2026-72536

CVE-2026-72536 (Chaskiq) is a missing-auth vulnerability in Chaskiq up to commit 46dfdd1 that lets unauthenticated remote attackers manipulate any tenant’s Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe ...

CVE-2026-72536 Chaskiq Chaskiq - Missing Authentication

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...