CVE-2026-65182 is a critical improper access control vulnerability in Apache Tomcat that allows security constraint bypass when a longer path constraint is specified before a more restrictive constraint for a shorter sub-path. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24. The vulnerability can lead to unauthorized access due to incorrect authorization checks. Fixed versions include 11.0.25, 10.1.58, and 9.0.121.
CVE-2026-38470 is a broken access control vulnerability in the API user endpoint of GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449. It allows authenticated users with normal user-created API tokens to enable or disable arbitrary user accounts via specific API actions. This vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized account status changes.
CVE-2026-55536 is a critical improper access control vulnerability in MervinPraison's PraisonAI multi-agent teams system. Before version 4.6.58, the Browser Server's _handle_connection() function incorrectly validates Chrome extension origins using an unanchored regular expression, allowing extra trailing characters to bypass checks. This flaw permits unauthorized start_session commands and browser automation. The issue is fixed in PraisonAI version 4.6.58.
CVE-2026-77997 is a medium severity vulnerability in the YOOtheme Pro extension for Joomla versions 1.0.0 through 5.0.41. It involves improper access control where users with com_template editing permissions can access information about arbitrary modules without having the necessary com_modules permissions. This could lead to unauthorized disclosure of privileged information.
Dell ThinOS 10 versions prior to 2605_10.2518 contain an improper access control vulnerability (CWE-284) that allows a low privileged local attacker to gain unauthorized access. This vulnerability has a high severity with a CVSS score of 7.8. No official patch or remediation guidance has been confirmed yet.
CVE-2026-76603 is a medium severity vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. It involves improper access control in the form.inlineedit controller, which does not perform access checks and allows unauthenticated users to disclose rows (items) they should not access.
CVE-2026-76597 is a high severity vulnerability in the Fabrik extension for Joomla versions up to 4.7.1. It allows unauthenticated attackers to upload arbitrary non-executable files to the web root via the list email plugin controller. This improper access control issue could lead to unauthorized file uploads, potentially impacting the affected web server environment.
An improper access control vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.1. The onAjax_getFolders method allows unauthenticated users to perform arbitrary directory listings. This vulnerability is identified as CWE-284 and CWE-22 and has a high severity with a CVSS 4.0 score of 8.7.
CVE-2026-76596 is a high-severity vulnerability in the Fabrik extension for Joomla versions up to 4.7.1. It allows unauthenticated attackers to truncate database tables via the list.doempty endpoint due to missing access control checks. This can result in significant data loss without requiring any privileges or user interaction.
CVE-2026-76600 is a medium severity vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. It allows unauthenticated users to delete any comment via the DeleteComment endpoint due to lack of access control checks.
A critical improper access control vulnerability (CWE-284) exists in the Fabrik extension for Joomla versions up to 4.7.3. The issue is due to a missing ACL check in the download element, allowing unauthorized access. This vulnerability has a CVSS 4.0 base score of 10. No official patch or remediation guidance has been provided yet.
A vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1 allows unauthenticated attackers to modify any comment via the onUpdateComment endpoint due to missing access control checks.
A vulnerability in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1 allows unauthenticated attackers to disclose any commenter's email address. This occurs because the onGetEmail endpoint does not perform access control checks. The issue is classified as improper access control (CWE-284) and has a medium severity with a CVSS score of 6.9.
CVE-2026-76599 is a high-severity vulnerability in the Fabrik extension for Joomla versions up to 4.7.1. It allows unauthenticated attackers to list arbitrary database tables and their prefixes via the ajax_tables method in the elements model. This improper access control issue can expose sensitive database structure information without requiring authentication.
An improper access control vulnerability (CWE-284) exists in the Fabrik extension for Joomla versions 1.0.0 through 4.7.1. The order plugin in these versions does not perform access checks on unauthenticated row reordering requests, allowing unauthorized users to reorder rows. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity.
A vulnerability in the JoomGallery extension for Joomla allows unauthenticated attackers to bypass password protection on gallery categories via the JSON view. While the HTML view enforces password protection correctly, the JSON format view does not check the password, exposing protected category data. This affects versions 4.0.0 through 4.3.0 of JoomGallery.
CVE-2026-16738 is a medium severity vulnerability in the Conekta Payment Gateway WordPress plugin before version 6.2.2. The plugin fails to verify the authenticity of incoming webhook notifications from the payment gateway and does not bind confirmed payments to the targeted orders or verify payment amounts. This flaw allows unauthenticated attackers to mark arbitrary orders as paid without actually making a payment.
Incus, a system container and virtual machine manager, has an improper access control vulnerability prior to version 7.2.0. This flaw allows an attacker who knows the name of a project and an instance within that project, without having authorization, to copy the instance to a new project. Exploiting this vulnerability could enable unauthorized access to secrets stored in instances. The issue is patched in version 7.2.0.
CVE-2026-55621 is an improper access control vulnerability in the Incus container and virtual machine manager prior to version 7.2.0. The flaw allows an attacker who knows the name of a project and a custom volume within it, but lacks authorization, to copy that volume to a new project. This can lead to unauthorized access to secrets stored in custom volumes. The issue is patched in version 7.2.0.
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.