CVE-2026-62440 is an improper access control vulnerability in the Kubernetes Service (CKS) plugin of Apache CloudStack. It allows unauthorized cross-tenant manipulation of Kubernetes clusters during node addition and removal. The issue affects Apache CloudStack versions from 4.21.0.0 through 4.22.1.0. Upgrading to version 4.22.1.1 or later resolves the vulnerability.
CVE-2026-65613 is a vulnerability in Apache CloudStack's Webhook module that allows exposure of sensitive information to unauthorized actors during listing and deleting deliveries. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-66797 is an improper access control vulnerability in Apache CloudStack's annotation functionality. It allows any authenticated user to create and view annotations on entities they do not own by bypassing ownership checks. The flaw affects versions from 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
A vulnerability in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.14 allows improper access control on certain admin REST API routes. The plugin incorrectly checks user capabilities by verifying only WooCommerce management capability instead of the more restrictive Dokan installation capability. This flaw permits users with Shop Manager roles to install and activate arbitrary Dokan plugin versions from WordPress.org.
The NewPath WildApricotPress Add-on WordPress plugin versions up to 1.0.0 contains an improper access control vulnerability. This flaw allows unauthenticated users to access a REST API route that should restrict member-only fields, exposing member email addresses and phone numbers configured as visible only to members. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-66309 is a critical improper access control vulnerability in Microsoft Azure SQL Database. It allows an authorized attacker to elevate privileges over a network, potentially leading to complete compromise of confidentiality, integrity, and availability of the database service. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.64. The issue arises because the comment controller endpoint does not enforce Access Control List (ACL) checks, allowing unauthenticated users to modify tags without authorization. This vulnerability has a medium severity rating with a CVSS score of 6.9.
An improper access control vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. This flaw allows unauthenticated attackers to take over ownership of listings by supplying arbitrary company and user IDs, even for listings that already have an owner. Version 6.2.3 fixes this issue by restricting the action to authenticated users and only permitting ownership changes for unowned listings.
CVE-2026-18466 is an improper access control vulnerability in the WP Maps WordPress plugin before version 4.9.8. The plugin fails to perform capability checks and nonce validation in one of its AJAX actions. This flaw allows users with Subscriber-level accounts to create unlimited database options, which are loaded on every page request, potentially impacting site performance.
The Eventin WordPress plugin versions before 4.1.21 contain an improper access control vulnerability. This flaw allows users with contributor-level access or higher to delete other users' accounts without verifying ownership or capability. The vulnerability can lead to complete deletion of user accounts, impacting confidentiality, integrity, and availability.
A vulnerability exists in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with local access to compromise the VirtualBox environment. The vulnerability affects confidentiality, integrity, and availability, potentially leading to full takeover of Oracle VM VirtualBox. The vulnerability is difficult to exploit and requires high privileges and local access. No explicit patch information is provided in the advisory.
A vulnerability exists in Oracle VM VirtualBox version 7.2.14 that allows a low privileged attacker with logon access to the host infrastructure to potentially compromise the VirtualBox environment. The vulnerability affects the core component and can lead to a complete takeover of Oracle VM VirtualBox, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, indicating a high severity with a scope change. No explicit patch information is provided in the advisory for this specific version.
CVE-2026-67442 is an improper access control vulnerability in frangoteam's FUXA web-based Process Visualization software. Versions prior to 1.3.3 have an issue where deleting a role does not fully remove the role identifier from users' role arrays or runtime caches. This can cause users to retain permissions that administrators intended to revoke, leading to residual privileges and inconsistent access control states. The issue is fixed in version 1.3.3.
CVE-2026-66780 is a vulnerability in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.11. The submariner-k8s-broker-cluster Role assigned to joined clusters has excessive permissions, allowing a compromised cluster to overwrite endpoint information of other clusters. This enables an attacker to redirect inter-cluster tunnel traffic and perform a Man-in-the-Middle (MITM) attack across the cluster mesh. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. Red Hat has released security updates in version 2.17.1 and later to address this and other issues. No known exploits are reported in the wild.
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0.
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5.
CVE-2026-73372 is an improper access control vulnerability in Joomla! CMS affecting versions 5.1.0 through 5.4.6 and 6.0.0 through 6.1.2. The flaw allows injection of contact information for inaccessible contact items into schema.org snippets due to improper ACL checks. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.
CVE-2026-72531 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. It allows unauthorized users with high privileges to create custom fields for components they should not access via webservice endpoints. The vulnerability has a medium severity with a CVSS score of 5.1.
CVE-2026-73371 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users with high privileges to perform batch copy operations on items they should not be able to edit. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1.