Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-121164 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121194 CVE record

CVSS 5.3 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121212 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121116 CVE record

CVSS 5.3 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121065 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121088 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121220 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121075 CVE record

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121030 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121040 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121136 CVE record

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121103 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121183 CVE record

CVSS 8.3 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121231 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121255 CVE record

CVSS 6.5 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121039 CVE record

CVSS 5.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121248 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121193 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121066 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121199 CVE record

CVSS 5.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121063 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121031 CVE record

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121062 CVE record

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121102 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121060 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121104 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121071 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121174 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121107 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-115732 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Certificate Name Authorization Bypass
- Perforce Puppet Enterprise
- Broken access control
- CWE-697
Not analysed yet 3 Nov 2026
CVE-2026-121509 CVE record

CVSS 6.9 Medium

Headless CMS Plugin REST API post get_required_post_data information disclosure
- Headless CMS Plugin
- Information disclosure
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-95860 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
- node-opcua
- Broken access control
- CWE-636
Not analysed yet 3 Nov 2026
CVE-2026-105821 CVE record

CVSS 8.3 High

Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy
- TP-Link Systems Inc. Tapo Cloud Service
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-63198 CVE record

CVSS 7.3 High

traQ: Privilege escalation by OAuth prompt=none request
- traPtitech traQ
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-116845 CVE record

CVSS 5.3 Medium

NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView
- netbox
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121631 CVE record

CVSS 2.3 Low

Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints
- lightdash
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-119509 CVE record

CVSS 5.3 Medium

WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability
- eranfl ClickCease Click Fraud Protection
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-97072 CVE record

CVSS 4.3 Medium

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability
- myCred
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-114187 CVE record

CVSS 5.3 Medium

WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability
- WPVibes AnyWhere Elementor
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-103077 CVE record

CVSS 4.3 Medium

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability
- myCred
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-119485 CVE record

CVSS 5.3 Medium

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
- weDevs Dokan
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-39777 CVE record

CVSS 4.3 Medium

WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability
- WC Lovers WCFM Membership
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-119487 CVE record

CVSS 5.3 Medium

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
- weDevs Dokan
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-116859 CVE record

CVSS 5.3 Medium

WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability
- WPMU DEV Forminator
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-39743 CVE record

CVSS 5.3 Medium

WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability
- WC Lovers WCFM Membership
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-120846 CVE record

CVSS 5.3 Medium

WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability
- Uncanny Owl Uncanny Automator
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-115298 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Elasticsearch Leading to Information Disclosure
- Elasticsearch
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-115295 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
- Elastic Kibana
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-115292 CVE record

CVSS 4.3 Medium

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
- Elastic Kibana
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-119495 CVE record

CVSS 5.3 Medium

WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability
- WebberZone Better Search
- Broken access control
Not analysed yet 3 Nov 2026
ash_authentication Hex

CVSS 7.6 High

AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
- Broken access control
>=5.0.0-rc.0, <5.0.0-rc.16 · fixed in 5.0.0-rc.16

GHSA-gx67-694c-655c · CVE-2026-119215 Not analysed yet 3 Nov 2026
CVE-2026-65140 CVE record

CVSS 5.7 Medium

Incorrect authorization in NVIDIA Slurm
- NVIDIA Slurm
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-65107 CVE record

CVSS 6.3 Medium

Missing authorization in NVIDIA Slurm
- NVIDIA Slurm
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121562 CVE record

CVSS 6.9 Medium

CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
- CTFd
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121560 CVE record

CVSS 7.1 High

LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts
- logchimp
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121558 CVE record

CVSS 2.3 Low

AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id
- Ricky-7-Yan intelligent-audit-system
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121556 CVE record

CVSS 8.7 High

FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints
- beecue FastBee
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121552 CVE record

CVSS 5.3 Medium

domain-admin before 1.6.79 Missing Authorization via getGroupUserList
- dromara domain-admin
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121543 CVE record

CVSS 8.7 High

smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
- a466350665 smart-sso
- Broken access control
Not analysed yet 3 Nov 2026
CVE-2026-121455 CVE record

CVSS 5.3 Medium

DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save
- dbgate
- Broken access control
Not analysed yet 3 Nov 2026