The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain an improper access control vulnerability that allows remote authenticated attackers to bypass localhost-only restrictions by spoofing the X-Forwarded-For header. This enables arbitrary writes to IDE configuration files such as ~/.cursor/mcp.json. The vulnerability has a medium severity with a CVSS score of 6.5.
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages.
The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim() correctly rejects withdrawals while an escrow is disputed, but the permissionless syncOutflow() path performs the same excess-balance transfer without checking disputed. After a streaming proposal is challenged, anyone can call syncOutflow() to transfer escrowed SuperTokens to the proposal beneficiary while the dispute is pending. If the proposal is later rejected, those tokens cannot be recovered by drainToStrategy(). This issue has been patched in 0xc9d4e0dacd937364793278180551e59d93cd43f9.
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert.
Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources.
This issue affects ash: from 0.4.0 before 3.32.2.
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
The miniOrange Oauth Client (free) extension for Joomla contains an improper access control vulnerability that allows unauthenticated attackers to uninstall arbitrary installed extensions. This issue affects only the free versions of the miniOrange plugins and arises from a missing authentication check. The vulnerability has a high severity score of 8.8 CVSS 4.0 and can lead to significant impact by enabling attackers to disrupt Joomla installations by removing extensions without authorization.
A vulnerability in the MasterStudy LMS WordPress Plugin before version 3.7.40 allows unauthenticated users to complete full-price orders by paying only a token amount. This occurs because the plugin does not properly verify payment notification details such as amount, receiver, currency, or status before marking orders as completed. This improper access control issue can lead to unauthorized access to paid content.
CVE-2026-77010 is a medium severity vulnerability in the HEL Online Classroom WordPress plugin version 1.0.3 and earlier. The plugin fails to perform proper authorization checks on its REST API routes and does not consistently enforce per-class access codes. This allows unauthenticated users to obtain signed meeting join links for any classroom, including those protected by access codes, and join with moderator privileges.
CVE-2026-77008 is a medium severity vulnerability in the HEL Online Classroom WordPress plugin (up to version 1.0.3). It allows unauthenticated users to overwrite plugin settings without any authorization or authentication checks. This includes the ability to redirect online classrooms and change the shared secret used to sign sessions.
The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress before version 1.6.3 contains an improper access control vulnerability. This flaw allows unauthenticated users to confirm paid appointments at a fraction of the intended price because the plugin does not verify the amount paid against the server-side price during online payment confirmation.
Arc, a SQL-native time-series database by Basekick-Labs, has an improper access control vulnerability in its Enterprise clustering feature. Versions from 26.02.1 up to but not including 26.06.2 allow unauthenticated cluster join requests when clustering is enabled but no shared secret is configured. This enables an attacker who knows the cluster name and can reach the coordinator port to join the cluster as a trusted node, manipulate cluster membership, intercept forwarded requests including authentication headers, and disrupt cluster operations. The default standalone configuration is not affected as clustering is disabled by default. The issue is fixed in version 26.06.2.
Kubeflow Pipelines versions prior to 2.17.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the frontend proxy middleware. This flaw allows attackers to send arbitrary HTTP or HTTPS requests to internal services without authentication, bypassing authorization controls. The vulnerability arises because the proxy route does not filter or restrict target addresses and remains accessible even when authorization is enabled. Exploitation can lead to unauthorized access to sensitive internal endpoints, including cloud metadata services and Kubernetes APIs. The issue is fixed in version 2.17.0.
CVE-2026-78618 is a business logic flaw in WatchGuard Dimension version 2.0 that allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request. The vulnerability has a medium severity with a CVSS score of 6.9. There is no official patch or remediation level currently provided by the vendor. The flaw requires high privileges (administrator) and does not involve user interaction. No known exploits are reported in the wild.