118812 matches found
CVE-2026-87069: Missing Authorization
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any...
CVE-2026-18185: Missing Authentication for Critical Function
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...
Linux Distros Unpatched Vulnerability : CVE-2026-95290
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access...
PT-2026-97203
Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB versions prior to 2.1.0 Description The plugin fails to properly verify if a user is authorized to perform specific actions. This missing authorization allows authenticated attackers with Contributor-level access or...
PT-2026-97503
Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description In the CopyAPIView located in awx/awx/api/generics.py, the permission classes is set to IsAuthenticated,, which prevents the Django REST Framework's get object from performing object-level...
PT-2026-97184
Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to perform a nonce, capability, or ownership check before executing a one-time payment-field migration during the construction of an admin screen. This...
PT-2026-97526
Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description Klever-Go, the Go implementation of the Klever blockchain protocol, fails to perform curve, prime-order subgroup, or nonzero validation on submitted BLSPublicKey during runtime validator...
CVE-2026-86842: Missing Authorization
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2026-76648: Missing Authorization
CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...
PT-2026-97364
Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Missing authentication on the Business Rules Manager commands REST endpoint allows a local actor to invoke unauthenticated commands. This ca...
CVE-2026-93507: Missing Authorization
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...
CVE-2026-73588: Missing Authentication for Critical Function
Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
Linux Distros Unpatched Vulnerability : CVE-2026-95278
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WakeLock. CVE-2026-95278 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenabl...
CVE-2026-96680: Missing Authorization
A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...
CVE-2026-52744: Missing Authorization
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...
Linux Distros Unpatched Vulnerability : CVE-2026-95320
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address...
Fedora 44 : chromium (2026-f910229c11)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f910229c11 advisory. Update to 153.0.8010.52 CVE-2026-91708: Race condition in Network CVE-2026-91709: Type confusion in ServiceWorker CVE-2026-91710: Use after free in...
CVE-2026-87074: Missing Authorization
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...
