CVE-2026-64965

ATutor 2.2.4 lacks authorization checks on test and question import endpoints, letting a low-privileged authenticated student bypass access controls and import content into a course. The product is no longer actively supported; no patch exists. No in-the-wild exploitation is reported. Migration t...

CVE-2026-64965 Missing Authorization Check in ATutor

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

EUVD-2026-63361

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-66609

creationtimestamp| type| source ---|---|--- 2026-08-20 13:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtje4cvrcx2e 2026-08-20 14:08:11+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtjgagqgjv2m...

CVE-2026-77079

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

CVE-2026-77080

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...

CVE-2026-77084

n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1 contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value wou...

CVE-2026-74014

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

CVE-2026-74018

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

CVE-2026-74016

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-73992

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-74001

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-66682

Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...

CVE-2026-66647

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66677

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66595

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2025-62307

HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...

CVE-2025-53999

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2025-15689

Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...

EUVD-2025-210753

HCL IntelliOps Event Management IEM is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges...