CVE-2026-72532

Joomla! Core (versions 4.0.0–5.4.7 and 6.0.0–6.1.2) contains an improper access control check in category webservice endpoints, allowing users with high privileges to create categories they should not be authorized to. CVSS 4.0 scores it MEDIUM (5.1) with network attack vector. The Joomla securit...

CVE-2026-72532 Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

CVE-2026-72532

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

CVE-2026-71574 Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

EUVD-2026-61025

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

CVE-2026-71574 Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

CVE-2026-71574

Joomla! 4.0.0-5.4.7 and 6.0.0-6.1.2 have inconsistent ACL checks on webservice endpoints, allowing authenticated users with high privileges to perform mutating actions that are restricted in the backend UI. CVSS 8.5 (HIGH) reflects confidentiality and integrity impact. No patch version is specifi...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-50138

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...

EUVD-2026-60813

Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73189

The WP Crowdfunding WordPress plugin (versions

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-74952

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154 and Thunderbird 154...

CVE-2026-23933 Hardcoded session key in Zabbix 7.4

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid...

CVE-2026-75587

creationtimestamp| type| source ---|---|--- 2026-08-18 12:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mte6yfl4r62d...

BIT-POWERSHELL-2026-58612 PowerShell Information Disclosure Vulnerability

Server-side request forgery ssrf in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network...

Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...