CVE-2026-15823

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

EUVD-2026-75236

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-15823 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-15823

The Builderall Cheetah For Wp WordPress plugin (versions ≤ 3.0.2 ) contains a missing authorization flaw in the wp_ajax_ba_cheetah_disable AJAX handler. The disable() function is registered without a capability or nonce check, and the target post ID is read directly from user-controlled $_POST['b...

CVE-2026-15823: Missing Authorization

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

PT-2026-89413

A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy...

PT-2026-89290

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-87994 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chatcompletion in backend/openwebui/main.py checked channel write access and channel membership for a supplied messageid but did not verify that the calling user...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

CVE-2026-46460

Dell PowerScale OneFS versions 9.5.0.0 through 9.7.1.15 , 9.8.0.0 through 9.13.1.0 , and prior to 9.15.0.0 are affected by an Incorrect Authorization vulnerability. A low-privileged attacker on the adjacent network can exploit this to perform unauthorized modification of system logs . The CVSS v3...

WordPress CalJ Shabbat Times plugin <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification vulnerability

Authenticated Subscriber+ Arbitrary Settings Modification vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin CalJ Shabbat Times versions = 1.5...

BIT-KIBANA-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

BIT-ELK-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-8615

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

EUVD-2026-74690

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

PT-2026-89265

Name of the Vulnerable Software and Affected Versions Builderall Cheetah For Wp versions prior to 3.0.3 Description Unauthorized modification of data is possible due to a missing capability check in the disable function. The wp ajax ba cheetah disable AJAX handler is registered without capability...

CVE-2026-8615: Missing Authorization

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

CVE-2026-88069: Improper Limitation of a Pathname to a Restricted Directory

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

Kibana 9.4.x < 9.4.6 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-122)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.6, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-122 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing...

CVE-2026-46460: Incorrect Authorization

Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized...