CVE-2026-77171 is an improper access control vulnerability in Nextcloud Collectives version 4.0.0. It allows recipients of a public shared collective link to create pages without proper authorization. The issue has a low severity rating with a CVSS score of 3.5.
CVE-2026-82986 is an improper access control vulnerability in Nextcloud Tables versions 0.6.4 through 1.0.0. It allows a user within a group to bypass administrator-imposed group restrictions on link sharing, enabling them to create share links for tables without having the required permission.
An improper access control vulnerability in
the IPC communication between TeamViewer Full Client or Host prior to version
15.83 and the Remote Management Monitoring component prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute scripts as
SYSTEM/root.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and several LTS releases contain an improper access control vulnerability (CWE-284) that could allow an unauthenticated remote attacker to cause a denial of service. The vulnerability affects multiple feature and LTS release versions. A fix is available in versions 8.9.0.0 or later and specific later LTS releases.
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.
CVE-2026-105482 is a high-severity vulnerability in Node.js affecting versions 22.23.3, 24.22.0, and 26.12.0. It involves improper access control in DNS resolution functions where hostnames containing a NUL byte are silently truncated, causing dns.resolve*() and dns.reverse() to resolve attacker-controlled names incorrectly. This flaw can lead to applications acting on DNS records for a different hostname than the one validated, potentially bypassing domain allowlists.
CVE-2026-106071 is an improper access control vulnerability in Node.js 26.x related to its permission model for filesystem access. The flaw allows access to filesystem paths that do not exactly match a specified wildcard rule due to early termination in the radix tree lookup. For example, a wildcard rule like --allow-fs-read=/etc/passwd.* unintentionally permits reading /etc/passwd. This issue requires the wildcard grant to be directly under the root of the permission tree and differs from CVE-2026-58043. The vulnerability has a low severity score and affects Node.js version 26.12.0.
Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain an improper access control vulnerability in the filesystem permission model. The function fs.realpathSync() lacks required read permission checks, allowing restricted code to bypass intended filesystem read restrictions. This is a partial regression of a previous fix that only covered fs.realpathSync.native().
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
ApostropheCMS versions prior to 3.7.0 in the import-export module contain an improper access control vulnerability. Authenticated users with import access can manipulate update-key values to match existing documents they have generic edit permissions on, potentially modifying unintended content. The vulnerability is mitigated by existing permission filters, preventing unauthorized overwrites of protected content. This issue is resolved in version 3.7.0.
### Summary
The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `<path-to-project-root>/etc/hosts`, the content of `/etc/hosts` was possible to be returned.
The content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `<project-root>/etc/hosts` could make Vite return the host's `/etc/hosts` file.
### Impact
Only apps that meet all of the following conditions are affected:
- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))
- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)
- the dev server is not running on Windows
### Details
When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.
For a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.
### PoC
The following example requires Linux with a readable `/etc/hostname`:
```bash
$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1
```
In another terminal:
```bash
$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file
```