Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-105876 CVE record

CVSS 5.3 Medium

WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability
- WP Chill Modula Image Gallery
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-92393 CVE record

CVSS 2.0 Low

Apache YuniKorn: Admission control bypass via workload UPDATE operation
- Apache Software Foundation Apache YuniKorn
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-103075 CVE record

CVSS 4.3 Medium

WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability
- WPMU DEV Hustle
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-93026 CVE record

CVSS 6.1 Medium

Missing authorization in Veeam Backup and Replication
- Veeam Backup and Replication
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-58068 CVE record

CVSS 6.8 Medium

Missing authorization in Veeam Agent for Windows
- Veeam Agent for Windows
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-102781 CVE record

CVSS 6.9 Medium

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6
- ordasoft.com Touch Slider extension for Joomla
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-82211 CVE record

CVSS 8.2 High

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure
- Nexi XPay Build
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-104678 CVE record

CVSS 2.7 Low

CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update
- CP Media Player
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-104651 CVE record

CVSS 4.3 Medium

Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
- Yaad Sarig Payment Gateway For WC
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-104050 CVE record

CVSS 4.3 Medium

Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers
- Academy LMS
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-104049 CVE record

CVSS 4.3 Medium

Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint
- Academy LMS
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-103681 CVE record

CVSS 4.3 Medium

Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete
- Frontend Dashboard
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-103323 CVE record

CVSS 5.9 Medium

Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
- Integration for Epos Now and WooCommerce
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-81535 CVE record

CVSS 6.3 Medium

wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
- wolfSSL Inc. wolfSSH
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-106471 CVE record

CVSS 8.1 High

Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-93678 CVE record

CVSS 7.6 High

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 7 Oct 2026
CVE-2026-97680 CVE record

CVSS 8.3 High

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-101329 CVE record

CVSS 6.5 Medium

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-104335 CVE record

CVSS 8.8 High

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-97626 CVE record

CVSS 4.3 Medium

Gitea profile feed disclosure bypassing user visibility
- Gitea
- Information disclosure
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-89182 CVE record

CVSS 5.4 Medium

Gitea push-to-create bypass of FORCE_PRIVATE policy
- Gitea
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-105268 CVE record

CVSS 4.3 Medium

Gitea issue attachment API allows changing comment attachments
- Gitea
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-105267 CVE record

CVSS 8.1 High

Gitea tag delete route deletes releases without release permission
- Gitea
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106497 CVE record

CVSS 4.3 Medium

Backstage: Inconsistent catalog property permission evaluation
- backstage
- @backstage plugin-catalog-backend
- Broken access control
- CWE-178
Not analysed yet 6 Oct 2026
CVE-2026-97208 CVE record

CVSS 4.9 Medium

Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
- Gitea
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-86684 CVE record

CVSS 7.1 High

Gitea push mirror local path check uses the repository owner
- Gitea
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106550 CVE record

CVSS 7.5 High

CVE-2026-106550
- Mozilla Node-convict
- Denial of service
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-105811 CVE record

CVSS 7.1 High

Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
- qnabot-on-aws
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-102157 CVE record

CVSS 6.8 Medium

Security Advisory 0190
- Arista Networks CloudVision CUE
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-103009 CVE record

CVSS 7.1 High

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
- Elasticsearch
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-103007 CVE record

CVSS 7.2 High

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
- Elasticsearch
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-102412 CVE record

CVSS 6.5 Medium

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
- Elastic Kibana
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-102410 CVE record

CVSS 4.3 Medium

Missing Authorization in Kibana Leading to Information Disclosure
- Elastic Kibana
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-102407 CVE record

CVSS 5.4 Medium

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
- Elasticsearch
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-102406 CVE record

CVSS 8.8 High

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
- Elastic Kibana
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-96589 CVE record

CVSS 4.3 Medium

Gitea private repository access retained after rejected transfer
- Gitea
- Broken access control
- CWE-672
Not analysed yet 6 Oct 2026
CVE-2026-94205 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Gitea fork workflow approval bypass through maintainer-triggered events
- Gitea
- Broken access control
- CWE-441
Not analysed yet 6 Oct 2026
CVE-2026-79960 CVE record

CVSS 7.1 High

Gitea deploy key pushes acting as the repository owner
- Gitea
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-104632 CVE record

CVSS 8.8 High

Gitea fork workflow approval bypass through cancel and rerun
- Gitea
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-79797 CVE record

CVSS 8.8 High

Improper Access Control in HPE Networking ClearPass Android Client Application
- Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106513 CVE record

CVSS 6.9 Medium

MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
- MISP
- Broken access control
- CWE-749
Not analysed yet 6 Oct 2026
CVE-2026-103620 CVE record

CVSS 6.0 Medium

Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
- GitHub Enterprise Server
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106511 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

CVE-2026-106511
- MultiversX Labs S.R.L. multisig-improved
- Authentication bypass
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106355 CVE record

CVSS 5.3 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106195 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106371 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106418 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106288 CVE record

CVSS 5.4 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106350 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106270 CVE record

CVSS 5.4 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106249 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106259 CVE record

CVSS 5.4 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106264 CVE record

CVSS 5.4 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106422 CVE record

CVSS 4.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106199 CVE record

CVSS 8.2 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106362 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106260 CVE record

CVSS 4.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106297 CVE record

CVSS 4.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106306 CVE record

CVSS 5.4 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-106187 CVE record

CVSS 4.2 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 6 Oct 2026