Broken access control.

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Devolutions Server

• Devolutions Server
• Broken access control

Payload didn't enforce field-level password update restrictions

• Broken access control

<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Payload vulnerable to API key disclosure through ordinary document reads

• Information disclosure
• Broken access control

>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Payload relationship-query authorization bypass

• Broken access control

<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

• SPIP Crayons Plugin
• Broken access control

Payload: Field access control bypass on auth collections

• payload
• Broken access control

Payload: Insufficient Access Control in Stripe REST Proxy

• Broken access control
• CWE-749

<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Payload: Improper access control for MCP API keys

• Broken access control

>=3.61.0, <3.88.0 · fixed in 3.88.0

Payload: Polymorphic join queries could disclose hidden fields

• Information disclosure
• Broken access control

>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Payload: Sort queries could expose protected field information

• Information disclosure
• Broken access control

<3.88.0 || >=4.0.0-canary.0, <4.0.0-canary.27 · fixed in 3.88.0, 4.0.0-canary.27

Missing authorization in Dell Container Storage Modules

• Dell Container Storage Modules
• Broken access control

SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)

• microsoft simplechat
• Command injection
• Broken access control

Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

• kvcache-ai Mooncake
• Broken access control

Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC

• kvcache-ai Mooncake
• Broken access control

Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

• kvcache-ai Mooncake
• Broken access control

Privilege abuse in model formsets with editable primary keys

• Django
• Broken access control

QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

• Webkul QloApps
• Broken access control

WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

• royalnavneet Delete All Comments of wordpress
• Broken access control

WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

• picu
• Broken access control

WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

• blubrry PowerPress Podcasting
• Broken access control

WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

• Marco van Wieren WPO365
• Broken access control

WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

• RealMag777 BEAR
• Broken access control

WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

• Progress Planner
• Broken access control

WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

• Beplusthemes Sermon'e
• Broken access control

WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

• Awesomemotive Easy Digital Downloads
• Broken access control

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

• PayPlug for WooCommerce (Official)
• Broken access control

WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

• wxdlabs WXD Backup Lite
• Broken access control

WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

• ThemetechMount TrueBooker
• Broken access control

WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

• Flipper Code – WordPress Development Company Advanced Posts Listing – Show Post List Easily
• Broken access control

WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

• WC Lovers WooCommerce Multivendor Marketplace – REST API
• Broken access control

WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

• 10Web Social Photo Feed
• Broken access control

WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability

• Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products
• Broken access control

WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability

• Wappointment
• Broken access control

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability

• PayPlug for WooCommerce (Official)
• Broken access control

WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability

• digitalpoint App for Cloudflare®
• Broken access control

WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

• Marcin Wise Chat
• Broken access control

WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

• techsupport ECPay Ecommerce for WooCommerce
• Broken access control

WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

• Tobias @Saleswonder.biz WP2LEADS
• Broken access control

Missing Authorization in Core

• Qualcomm, Inc. Snapdragon
• Broken access control

File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

• File Media Renamer
• Broken access control

Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

• Fast Courier
• Broken access control

elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

• elegro Crypto Payment
• Broken access control

WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability

• WP Manage Ninja Fluent Affiliate Pro
• Broken access control

WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

• Green Invoice Morning for WooCommerce
• Broken access control

WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

• wallstrdev WDS MCP Content Manager
• Broken access control

WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability

• iatoai IATO MCP
• Broken access control

WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability

• ZWEISCHNEIDER Faktur Pro for WooCommerce
• Broken access control

WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability

• WP Manage Ninja FluentBooking Pro
• Broken access control

SourceCodester Drug Recommendation System cross-site request forgery

• SourceCodester Drug Recommendation System
• Cross-site request forgery (CSRF)
• Broken access control

PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization

• PHPGurukul User Registration & Login and User Management System
• Broken access control

jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization

• jishenghua jshERP
• Privilege escalation
• Broken access control

chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization

• chillzhuang SpringBlade
• Privilege escalation
• Broken access control

chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization

• chillzhuang SpringBlade
• Privilege escalation
• Broken access control

PickMall Lilishop Buyer Invoice List receipt authorization

• PickMall Lilishop
• Broken access control

PickMall Lilishop Mobile Binding bindMobile improper authorization

• PickMall Lilishop
• Privilege escalation
• Broken access control

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

• Information disclosure
• Broken access control

>=2.82.0, <2.118.1 · fixed in 2.118.1

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

• Denial of service
• Broken access control

<0.30.0 · fixed in 0.30.0

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

• Broken access control

<0.30.0 · fixed in 0.30.0