Veno File Manager Project 4.4.9 contains an incorrect access control vulnerability in the /vfm-admin/admin-panel/view/save-cvs.php endpoint. This flaw allows an unauthenticated attacker to extract application logs from a specified date onwards by sending a specially crafted POST request. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.
CVE-2026-81573 is a high-severity vulnerability in Wibu-Systems-AG CodeMeter Runtime versions before 8.41a or 9.10 when configured as a server. The configuration command handler fails to enforce network-origin restrictions, allowing remote attackers to execute commands intended only for local or same-network clients. This can lead to unauthorized reading of sensitive configuration data and overwriting values in Server.ini, including the hash of credentials for the CodeMeter WebAdmin, potentially enabling WebAdmin takeover.
A vulnerability in the Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through version 0.4.62 allows any authenticated user to update stock quantities of arbitrary products without proper capability checks.
A vulnerability in the Joomla Event Manager (JEM) extension for Joomla allows unauthenticated users holding their own session token to overwrite and force-publish articles associated with events. This affects versions from 1.0.0 through 5.0.0. The issue is due to improper access control, classified as CWE-284. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.
Weblate versions prior to 2026.7 have an improper access control vulnerability where two-factor authentication (2FA) enforcement is inconsistent. While teams can require 2FA for team permissions, this requirement is not enforced for site-wide global permissions. As a result, users without 2FA configured can still receive and act on global permissions, including accessing the site management interface. This issue is fixed in version 2026.7.
Dell iDRAC9 versions prior to 7.00.00.182 for 14G and prior to 7.20.30.50 for 15G/16G contain an improper access control vulnerability. This flaw could allow an unauthenticated remote attacker to gain unauthorized access to data. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation level has been confirmed yet.
Winter CMS versions up to and including 1.2.12 contain an improper access control vulnerability in the backend FileUpload form widget. This flaw allows an authenticated backend user to read and modify attachment records belonging to other users due to insufficient verification of file ownership. The vulnerability is fixed in version 1.2.13.
CVE-2026-77557 is a critical Improper Access Control vulnerability in Ubiquiti Inc's UniFi Protect AI Key. It allows a malicious actor with network access to escalate privileges on the affected device without requiring user interaction. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-77553 is a critical Improper Access Control vulnerability in Ubiquiti Inc's UniFi Access Application. It allows a malicious actor with network access and low privileges to escalate their privileges on the host device. The vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-77551 is an improper access control vulnerability in Ubiquiti Inc's UniFi Connect Display Cast Pro. A malicious actor with network access could exploit this flaw to escalate privileges on the device. The vulnerability has a critical severity with a CVSS score of 9. No specific affected versions or patches are currently documented.
CVE-2026-77541 is an improper access control vulnerability in the Ubiquiti Inc UniFi Network Application. It allows a malicious actor with network access and high privileges to escalate their privileges within the application. The vulnerability has a critical severity with a CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability. No specific affected versions or patch information are provided.
CVE-2026-77538 is an improper access control vulnerability in the Ubiquiti Inc UniFi Connect Application. It allows a malicious actor with network access to escalate privileges within the application. The vulnerability has a high severity score of 8.2 and does not currently have a known patch or official remediation. No known exploits are reported in the wild.
CVE-2026-77536 is a critical Improper Access Control vulnerability in Ubiquiti Inc's UniFi OS Server. It allows a malicious actor with network access and low privileges to escalate their privileges within affected UniFi OS devices or instances. The vulnerability has a CVSS score of 9.9, indicating a high severity with potential complete compromise of confidentiality, integrity, and availability. No specific affected versions or patches have been disclosed yet, and no known exploits are reported in the wild.
CVE-2026-77534 is a critical Improper Access Control vulnerability in Ubiquiti Inc's UniFi OS Server. It allows a malicious actor with network access and low privileges to escalate their privileges within affected UniFi OS devices or instances. The vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No specific affected versions or patches have been disclosed yet. There are no known exploits in the wild at this time.
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
CVE-2026-58108 is an improper access control vulnerability in Ericsson CodeChecker version 6.26.0. The flaw arises because a personal access token removal query filters on columns from a different table without a proper join, causing an implicit cross join. This allows a user to delete all personal access tokens in the system instead of only their own. The vulnerability has a low CVSS score of 1.2 and no known exploits in the wild.
Return Refund and Exchange For WooCommerce plugin versions 4.4.6 and earlier contain an improper access control vulnerability. This flaw allows unauthenticated users to interact with guest orders via certain AJAX actions without verifying ownership. Exploitation can lead to unauthorized reading of private order messages, posting messages and attachments as the customer, and canceling return requests on guest orders.
The Project Manager WordPress plugin before version 4.0.7 has an improper access control vulnerability in its REST API routes. This flaw allows any authenticated user, including low-privilege roles like subscribers, to access and modify projects they do not belong to. Specifically, unauthorized users can read task content and user email addresses from other projects and modify task boards.
CVE-2026-16986 is a medium severity vulnerability in the Booking Package WordPress plugin before version 1.7.25. It allows an unauthenticated attacker to manipulate the payment amount by exploiting improper access control, paying less than the actual service price. The plugin does not validate the payment amount server-side against the stored service price, instead relying on attacker-supplied request values.
A vulnerability in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 allows unauthenticated users to access a REST route without authorization. This flaw exposes stored account data including the connected service's API secret and account details. Exploiting this can enable attackers to disconnect the plugin's integration with the connected service.