Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-109524 CVE record

CVSS 6.9 Medium

girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
- girishsaraf Online-Appointment-Booking-System
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-74040 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
- wazuh-manager
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-74036 CVE record

CVSS 8.6 High

Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
- wazuh-agent
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-74035 CVE record

CVSS 8.6 High

Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
- wazuh-manager
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-74034 CVE record

CVSS 8.7 High

Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
- wazuh-manager
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-74032 CVE record

CVSS 5.3 Medium

Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
- wazuh-manager
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109963 CVE record

CVSS 5.3 Medium

Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
- froxlor
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109962 CVE record

CVSS 5.3 Medium

Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
- froxlor
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109957 CVE record

CVSS 5.3 Medium

EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
- espocrm
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-65172 CVE record

CVSS 8.6 High

Missing authorization in NVIDIA AIStore framework
- NVIDIA AIStore framework
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109764 CVE record

CVSS 5.4 Medium

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109750 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Web Authentication component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-94410 CVE record

CVSS 5.3 Medium

Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service
- Bender Customer&Partner
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-89204 CVE record

CVSS 5.3 Medium

Insecure direct object reference in Siemens RUGGEDCOM CROSSBOW
- Siemens RUGGEDCOM CROSSBOW
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-89202 CVE record

CVSS 7.1 High

Insecure direct object reference in Siemens RUGGEDCOM CROSSBOW
- Siemens RUGGEDCOM CROSSBOW
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-89199 CVE record

CVSS 8.7 High

Insecure direct object reference in Siemens RUGGEDCOM CROSSBOW
- Siemens RUGGEDCOM CROSSBOW
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109699 CVE record

CVSS 5.4 Medium

WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
- ThemeGrill User Registration
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106598 CVE record

CVSS 5.3 Medium

WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability
- ThemeGrill User Registration
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109116 CVE record

CVSS 6.9 Medium

AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization
- AdithyaYelloju Restaurant-Management-System
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-108174 CVE record

CVSS 5.3 Medium

WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability
- PluginUs.Net FOX
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106597 CVE record

CVSS 5.3 Medium

WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
- ThemeGrill User Registration
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-101020 CVE record

CVSS 8.5 High

Incorrect permission assignment in Hammock Corporation AssetView and others
- Hammock Corporation AssetView
- Hammock Corporation AssetView CLOUD
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109696 CVE record

CVSS 5.4 Medium

WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability
- WP ManageNinja LLC FluentBoards
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109684 CVE record

CVSS 5.3 Medium

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
- TMS Amelia
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-108496 CVE record

CVSS 5.3 Medium

WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability
- WP User Manager
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-108493 CVE record

CVSS 5.3 Medium

WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability
- Karolína Vyskočilová Pay for Payment for WooCommerce
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-108492 CVE record

CVSS 5.3 Medium

WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability
- Fullworks Plugins Quick Paypal Payments
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-109703 CVE record

CVSS 5.3 Medium

WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability
- WPGraphQL
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-108975 CVE record

CVSS 6.9 Medium

SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload
- SourceCodester Library Management System
- Broken access control
- Unrestricted file upload
Not analysed yet 13 Oct 2026
CVE-2026-108974 CVE record

CVSS 6.9 Medium

SourceCodester E-Learning System Users.php save_users unrestricted upload
- SourceCodester E-Learning System
- Broken access control
- Unrestricted file upload
Not analysed yet 13 Oct 2026
CVE-2026-108973 CVE record

CVSS 6.9 Medium

SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload
- SourceCodester Contact Tracing System
- Broken access control
- Unrestricted file upload
Not analysed yet 13 Oct 2026
CVE-2026-108948 CVE record

CVSS 5.3 Medium

code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
- code-projects Online Reviewer System
- Broken access control
- CWE-913
Not analysed yet 13 Oct 2026
CVE-2026-5954 CVE record

CVSS 4.2 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-6567 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-9268 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-14552 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-16275 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-16301 CVE record

CVSS 8.5 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-78335 CVE record

CVSS 4.2 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-81839 CVE record

CVSS 7.7 High

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-82632 CVE record

CVSS 3.1 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-84284 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-85529 CVE record

CVSS 5.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-92528 CVE record

CVSS 4.2 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-103549 CVE record

CVSS 2.7 Low

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-89124 CVE record

CVSS 4.3 Medium

Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)
- SAP_SE SAP HANA (Display Product Catalog Based on Customs Declaration)
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-89121 CVE record

CVSS 4.7 Medium

Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
- SAP_SE SAP S/4HANA (Linear Asset Management RAP Business Object)
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-89112 CVE record

CVSS 6.5 Medium

Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure
- SAP_SE CLA-Assistant
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-89108 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
- SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service)
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2024-34323 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2024-34320 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-108938 CVE record

CVSS 6.9 Medium

code-projects Matrimonial System matrimony.sql file access
- code-projects Matrimonial System
- Broken access control
- Information disclosure
Not analysed yet 12 Oct 2026
CVE-2026-17475 CVE record

CVSS 7.1 High

IBM Planning Analytics Local is affected by security vulnerabilities
- IBM Planning Analytics
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109675 CVE record

CVSS 5.3 Medium

Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
- frappe suite
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109672 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109669 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109668 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109666 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109665 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109664 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026