Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-42690 CVE record

CVSS 5.4 Medium

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
- ThimPress LearnPress
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-85330 CVE record

CVSS 4.3 Medium

Microsoft Edge for Android Security Feature Bypass Vulnerability
- Microsoft Edge (Chromium-based)
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-114148 CVE record

CVSS 7.8 High

ASP.NET Core Elevation of Privilege Vulnerability
- Microsoft .NET 10.0 installed on Linux
- Microsoft .NET 10.0 installed on Mac OS
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-103092 CVE record

CVSS 8.5 High

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-104316 CVE record

CVSS 6.5 Medium

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-107327 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-110196 CVE record

CVSS 8.8 High

Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-109891 CVE record

CVSS 6.4 Medium

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability
- weDevs Happy Addons for Elementor
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-25448 CVE record

CVSS 4.3 Medium

WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability
- weDevs WP ERP
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-42691 CVE record

CVSS 5.4 Medium

WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability
- EventPrime
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-54852 CVE record

CVSS 5.3 Medium

WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability
- miniOrange Page Restriction WordPress (WP)
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-97073 CVE record

CVSS 5.3 Medium

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability
- myCred
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-54853 CVE record

CVSS 5.3 Medium

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability
- Cozmoslabs Profile Builder
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-27063 CVE record

CVSS 5.3 Medium

WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability
- Kit (formerly ConvertKit)
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115601 CVE record

CVSS 5.3 Medium

WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability
- WP Desk Custom Price for WooCommerce
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115605 CVE record

CVSS 4.3 Medium

WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability
- Brainstorm Force SureDash
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-54871 CVE record

CVSS 5.3 Medium

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability
- Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-25450 CVE record

CVSS 5.3 Medium

WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability
- ThemeGrill User Registration
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-114181 CVE record

CVSS 5.3 Medium

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability
- Magepeople inc. Taxi Booking Manager for WooCommerce
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-118088 CVE record

CVSS 5.3 Medium

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
- WPFunnels
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-116856 CVE record

CVSS 5.3 Medium

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability
- WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-118091 CVE record

CVSS 5.3 Medium

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
- WPFunnels
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-116387 CVE record

CVSS 5.3 Medium

WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability
- Brainstorm Force SureForms
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-118092 CVE record

CVSS 4.3 Medium

WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability
- StylemixThemes MasterStudy LMS
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-116406 CVE record

CVSS 4.3 Medium

WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability
- Webba Plugins Webba Booking
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-52708 CVE record

CVSS 4.3 Medium

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability
- weDevs WP User Frontend
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-116846 CVE record

CVSS 5.3 Medium

WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability
- WP User Manager
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-48884 CVE record

CVSS 5.3 Medium

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability
- weDevs WP User Frontend
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-80069 CVE record

CVSS 5.3 Medium

MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
- Stylemix MasterStudy LMS WordPress Plugin
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115712 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings
- Elastic Cloud Enterprise
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115706 CVE record

CVSS 6.8 Medium

Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
- Elastic Cloud Enterprise
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-39782 CVE record

CVSS 5.3 Medium

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability
- Kaliforms Kali Forms
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-113696 CVE record

CVSS 5.3 Medium

Improper Authorization in BMC ITSM SmartIT Change Approvals
- BMC IT Service Management Suite
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-93010 CVE record

CVSS 4.3 Medium

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
- Red Hat Ceph Storage 9
- Red Hat Enterprise Linux 10
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-113694 CVE record

CVSS 5.3 Medium

Improper Authorization in BMC ITSM SmartIT Attachments
- BMC IT Service Management Suite
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-119049 CVE record

CVSS 7.2 High

FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming
- idinging FreeMail
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-119048 CVE record

CVSS 2.3 Low

JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module
- thinkgem JeeSite
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-42707 CVE record

CVSS 4.3 Medium

WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability
- HivePress Claim Listings
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-39741 CVE record

CVSS 5.3 Medium

WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability
- RelyWP Simple Cloudflare Turnstile
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-22386 CVE record

CVSS 4.3 Medium

WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability
- Ahmad WP Job Portal
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-42703 CVE record

CVSS 6.5 Medium

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability
- Kaliforms Kali Forms
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-39735 CVE record

CVSS 6.5 Medium

WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability
- Crocoblock JetEngine
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-118093 CVE record

CVSS 5.3 Medium

WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability
- WPFunnels Team Product Feed Manager
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-27401 CVE record

CVSS 5.3 Medium

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability
- YITH PayPal Express Checkout for WooCommerce
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-112827 CVE record

CVSS 7.1 High

WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability
- VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-114193 CVE record

CVSS 7.5 High

WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
- Eyal Fitoussi GEO my WordPress
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115599 CVE record

CVSS 7.5 High

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- ThimPress LearnPress
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115963 CVE record

CVSS 7.1 High

WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability
- VideoWhisper.com Broadcast Live Video
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-111417 CVE record

CVSS 7.5 High

Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service
- Foxit Software Inc. foxit.com
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-117627 CVE record

CVSS 5.4 Medium

Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-19610 CVE record

CVSS 6.5 Medium

Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
- Red Hat JBoss Enterprise Application Platform 8.1
- Red Hat JBoss Enterprise Application Platform 7
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-85007 CVE record

CVSS 3.8 Low

YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
- Video Player for YouTube
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115259 CVE record

CVSS 4.9 Medium

Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
- Photo Engine (Media Organizer & Lightroom)
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-110030 CVE record

CVSS 5.3 Medium

Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
- Hide Price Until Login
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-108763 CVE record

CVSS 4.3 Medium

Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
- Wallet System for WooCommerce
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-108685 CVE record

CVSS 3.7 Low

WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
- WP Post Author
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-78395 CVE record

CVSS 5.3 Medium

Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
- Link Library
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-115302 CVE record

CVSS 5.3 Medium

Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
- Contact Form by Supsystic
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-42949 CVE record

CVSS 5.6 Medium

Improper authorization in Frangoteam
- Frangoteam
- Broken access control
Not analysed yet 29 Oct 2026
CVE-2026-42922 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper authorization in Frangoteam
- Frangoteam
- Broken access control
Not analysed yet 29 Oct 2026