EUVD-2026-61028

Joomla! Core - 20260808 - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items...

EUVD-2026-61027

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

CVE-2026-72532

Joomla! Core (versions 4.0.0–5.4.7 and 6.0.0–6.1.2) contains an improper access control check in category webservice endpoints, allowing users with high privileges to create categories they should not be authorized to. CVSS 4.0 scores it MEDIUM (5.1) with network attack vector. The Joomla securit...

CVE-2026-72532

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

CVE-2026-72532 Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

CVE-2026-71574 Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

CVE-2026-71574 Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

CVE-2026-71574

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

EUVD-2026-61025

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

CVE-2026-71574

Joomla! 4.0.0-5.4.7 and 6.0.0-6.1.2 have inconsistent ACL checks on webservice endpoints, allowing authenticated users with high privileges to perform mutating actions that are restricted in the backend UI. CVSS 8.5 (HIGH) reflects confidentiality and integrity impact. No patch version is specifi...

CVE-2026-49226

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-50138

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...

mysql: Performance Schema unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Performance Schema. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

mysql: X Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

CVE-2026-50138

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...

CVE-2026-24301

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

EUVD-2026-60813

Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73189

The WordPress WP Crowdfunding plugin (versions below 2.2.1) has an IDOR vulnerability allowing authenticated subscribers to access other users' data via direct object references. Patchstack reports a CVSS 6.5 (MEDIUM) with HIGH confidentiality impact. Exploitation in the wild is not documented; u...