Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-120554 CVE record

CVSS 8.8 High

Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
- carazo Import and export users and customers
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-94460 CVE record

CVSS 7.2 High

IRISPowerscan Insecure default privilege assignment for installation account
- I.R.I.S S.A. IRISPowerscan
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-62000 CVE record

CVSS 7.5 High

WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability
- WC Lovers WCFM Marketplace
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-121817 CVE record

CVSS 8.7 High

About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference
- About Time Technologies Herowatch Go Server
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-16511 CVE record

CVSS 8.8 High

Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
- zephyr
- Memory corruption
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-118407 CVE record

CVSS 5.4 Medium

Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
- Premium Packages
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-118403 CVE record

CVSS 3.7 Low

Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
- Premium Packages
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-115257 CVE record

CVSS 5.3 Medium

WP Roster < 2.36 - Unauthenticated Roster Data Modification
- WP Roster
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-115241 CVE record

CVSS 6.5 Medium

WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID
- WPvivid — Backup, Migration & Staging
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-110964 CVE record

CVSS 6.5 Medium

Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR
- Essential Real Estate
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-108068 CVE record

CVSS 3.8 Low

FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard
- FV Flowplayer Video Player
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-108067 CVE record

CVSS 3.8 Low

FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
- FV Flowplayer Video Player
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-106000 CVE record

CVSS 5.3 Medium

Booking Package < 1.7.34 - Unauthenticated Payment Bypass
- Booking Package
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-101166 CVE record

CVSS 3.7 Low

Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order
- Mollie Payments for WooCommerce
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-101165 CVE record

CVSS 3.7 Low

Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay
- Mollie Payments for WooCommerce
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-121618 CVE record

CVSS 6.9 Medium

Linksys E5600 Factory Quality Control fqc.cgi information disclosure
- Linksys E5600
- Information disclosure
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-110464 CVE record

CVSS 6.9 Medium

Missing authorization in ASUS Armoury Crate
- ASUS Armoury Crate
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-92200 CVE record

CVSS 7.8 High

Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- Quest Foglight for Databases
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-92191 CVE record

CVSS 8.8 High

Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability
- Quest Foglight for Databases
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-118626 CVE record

CVSS 5.4 Medium

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
- MLflow
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-118625 CVE record

CVSS 6.3 Medium

MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability
- MLflow
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-118624 CVE record

CVSS 5.4 Medium

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability
- MLflow
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121585 CVE record

CVSS 5.3 Medium

InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
- InfiniFlow RAGFlow
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121583 CVE record

CVSS 5.3 Medium

Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization
- Sanluan PublicCMS
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121582 CVE record

CVSS 6.9 Medium

Umami Record API Endpoint route.ts authorization
- Umami
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121734 CVE record

CVSS 6.0 Medium

ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView
- zane-ops
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121732 CVE record

CVSS 2.1 Low

RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
- francoisjacquet RosarioSIS
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121730 CVE record

CVSS 7.1 High

emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
- 0xdps emailflare
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121729 CVE record

CVSS 7.2 High

emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
- 0xdps emailflare
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121728 CVE record

CVSS 6.9 Medium

SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2
- SourceHut meta.sr.ht
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121539 CVE record

CVSS 5.3 Medium

miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control
- miroslavpejic85 MiroTalk P2P
- Privilege escalation
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-116661 CVE record

CVSS 6.5 Medium

Tanium addressed an improper access controls vulnerability in Enforce.
- Tanium Enforce
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-116667 CVE record

CVSS 4.2 Medium

Tanium addressed an improper access controls vulnerability in Discover.
- Tanium Discover
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-116664 CVE record

CVSS 3.1 Low

Tanium addressed an improper access controls vulnerability in Discover.
- Tanium Discover
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-116663 CVE record

CVSS 6.5 Medium

Tanium addressed an improper access controls vulnerability in Enforce.
- Tanium Enforce
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-116669 CVE record

CVSS 6.5 Medium

Tanium addressed an improper access controls vulnerability in Discover.
- Tanium Discover
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121541 CVE record

CVSS 5.6 Medium

Bake filesystem path entitlements approval can be skipped in some multi-target builds
- Docker Buildx
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-120930 CVE record

CVSS 5.4 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121195 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121169 CVE record

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121142 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121232 CVE record

CVSS 5.1 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121041 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121029 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121225 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121205 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121159 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121085 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121251 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121172 CVE record

CVSS 5.4 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121253 CVE record

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121101 CVE record

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121111 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121252 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121157 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121222 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121046 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121167 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121091 CVE record

CVSS 5.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121042 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026