Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-96834 CVE record

CVSS 6.5 Medium

WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability
- Liquid Web / StellarWP GiveWP
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-96823 CVE record

CVSS 7.5 High

WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
- CusRev Customer Reviews for WooCommerce
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-96818 CVE record

CVSS 7.5 High

WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
- mra13 / Team Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments)
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-96817 CVE record

CVSS 8.2 High

WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability
- MakeCommerce.net MakeCommerce for WooCommerce
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-96348 CVE record

CVSS 7.5 High

WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
- Bookly
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-96347 CVE record

CVSS 6.5 Medium

WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability
- Bookly
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-95587 CVE record

CVSS 7.5 High

WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
- Hostinger Migrator
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-94673 CVE record

CVSS 5.3 Medium

WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability
- NSquared Simply Schedule Appointments
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-94672 CVE record

CVSS 4.3 Medium

WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability
- 10up Safe SVG
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-94499 CVE record

CVSS 7.1 High

WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
- wpWax FormGent
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-94173 CVE record

CVSS 5.4 Medium

WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability
- Strategy11 Team Business Directory
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-94120 CVE record

CVSS 7.5 High

WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
- GravityKit GravityExport Lite for Gravity Forms
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-94074 CVE record

CVSS 6.5 Medium

WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
- NSquared Simply Schedule Appointments
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-62081 CVE record

CVSS 5.4 Medium

WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability
- wpdesk Flexible PDF Coupons
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-74865 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Authentication Bypass in sogo_yhn
- YunoHost-Apps sogo_yhn
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-74864 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Authentication Bypass in sogo_yhn
- YunoHost-Apps sogo_yhn
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-13720 CVE record

CVSS 5.4 Medium

Editor can forge file-provisioning provenance on dashboards via the dashboard API
- Grafana OSS
- Grafana Enterprise
- Broken access control
- CWE-345
Not analysed yet 30 Sept 2026
CVE-2026-13719 CVE record

CVSS 4.3 Medium

Alert rules in restricted folders disclosed via the alert rules list API
- Grafana Enterprise
- Grafana OSS
- Information disclosure
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-96342 CVE record

CVSS 6.9 Medium

WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability
- Amauri.IO WPMobile.App
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103239 CVE record

CVSS 8.6 High

MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
- MISP
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103237 CVE record

CVSS 8.3 High

MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
- MISP
- Broken access control
- CWE-20
Not analysed yet 30 Sept 2026
CVE-2026-103235 CVE record

CVSS 8.7 High

MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
- MISP
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102584 CVE record

CVSS 4.3 Medium

Moodle: missing capability check allows unauthorised grade penalty recalculation
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102583 CVE record

CVSS 2.7 Low

Moodle: incorrect capability check in ai generate image web service
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102582 CVE record

CVSS 2.2 Low

Moodle: manual enrolment page accessible when plugin disabled
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-94297 CVE record

CVSS 2.7 Low

Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation
- Media Library Organizer
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-93580 CVE record

CVSS 5.3 Medium

InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
- InPost PL
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-89190 CVE record

CVSS 4.3 Medium

Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax
- Robin Image Optimizer
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-88797 CVE record

CVSS 7.1 High

Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation
- Vayu X
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-85576 CVE record

CVSS 4.3 Medium

All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
- All in One Files Upload
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-75824 CVE record

CVSS 5.3 Medium

WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
- User Frontend
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-103105 CVE record

CVSS 8.8 High

Incorrect authorization in Pexip Infinity
- Pexip Infinity
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102846 CVE record

CVSS 5.1 Medium

gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization
- gedelumbung HospitalManagement
- Privilege escalation
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102845 CVE record

CVSS 6.9 Medium

gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure
- gedelumbung HospitalManagement
- Information disclosure
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102844 CVE record

CVSS 5.1 Medium

gedelumbung HospitalManagement laporan_data_pasien.php detail authorization
- gedelumbung HospitalManagement
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-102842 CVE record

CVSS 5.3 Medium

gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
- gedelumbung HospitalManagement
- Broken access control
- Unrestricted file upload
Not analysed yet 30 Sept 2026
CVE-2026-103054 CVE record

CVSS 7.1 High

AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP
- beenuar AiSOC
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-51869 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-51867 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.
- Broken access control
Not analysed yet 30 Sept 2026
CVE-2026-86101 CVE record

CVSS 7.2 High

Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access
- WatchGuard Fireware OS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-90441 CVE record

CVSS 7.1 High

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B
- WatchGuard Fireware OS
- Information disclosure
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-86105 CVE record

CVSS 5.3 Medium

Fireware OS Improper Authorization in Access Portal Reverse Proxy
- WatchGuard Fireware OS
- Path traversal
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-86136 CVE record

CVSS 7.1 High

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A
- WatchGuard Fireware OS
- Path traversal
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-81842 CVE record

CVSS 4.3 Medium

Library panel can be moved into a folder without library panel create permission
- Grafana Enterprise
- Grafana OSS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-94204 CVE record

CVSS 8.7 High

Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application
- Viidure Dashcam Android Application
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-81841 CVE record

CVSS 5.3 Medium

Paused shared dashboard access tokens still expose data source configuration
- Grafana Enterprise
- Grafana OSS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102876 CVE record

CVSS 8.6 High

SurrealDB before 3.3.0 Cross-Tenant Access via Headers
- surrealdb
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102330 CVE record

CVSS 6.5 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102327 CVE record

CVSS 7.5 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102310 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102320 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-61519 CVE record

CVSS 8.7 High

Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()
- Liberu Software Liberu CRM
- Broken access control
Not analysed yet 29 Sept 2026
adm-zip npm

CVSS 7.1 High

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
- Broken access control
<0.6.1 · fixed in 0.6.1

GHSA-j5f4-cc29-5x44 · CVE-2026-102282 Not analysed yet 29 Sept 2026
CVE-2026-84414 CVE record

CVSS 7.8 High

IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []
- i
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95340 CVE record

CVSS 4.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95296 CVE record

CVSS 4.3 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95342 CVE record

CVSS 4.3 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95368 CVE record

CVSS 4.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95352 CVE record

CVSS 5.4 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95292 CVE record

CVSS 4.8 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026