The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.
The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `placement_update_item()` function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update ad placements, allowing them to change which ad or ad group a placement serves.
The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.
Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4.1.1, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.
Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Dinosoft ERP: from < 3.0.1 through 11022026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested paging (SNP) initialization, potentially resulting in a loss of guest memory confidentiality and integrity.
On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
CVE-2026-25231 is a high-severity vulnerability in FileRise versions prior to 3.3.0, a self-hosted web file manager and WebDAV server. The flaw arises from improper access control on the /uploads directory, allowing unauthenticated users to read files if they know or guess the file path. This can lead to exposure of sensitive data and privacy breaches without requiring any authentication or user interaction. The vulnerability does not impact integrity or availability but poses a significant confidentiality risk. It is fixed in version 3.3.0. European organizations using vulnerable versions of FileRise should prioritize upgrading to mitigate potential data leaks.
CVE-2026-20987 is a high-severity vulnerability in Samsung Mobile's GalaxyDiagnostics application caused by improper input validation, allowing local privileged attackers to execute privileged commands. It affects versions prior to 3.5.050 and requires high privileges for exploitation, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full privileged command execution. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to affected devices. European organizations using Samsung Galaxy devices with GalaxyDiagnostics are at risk, especially those in sectors with sensitive data or critical infrastructure. Mitigation involves promptly updating to GalaxyDiagnostics version 3.5.050 or later, restricting local privileged access, and monitoring for suspicious local activity.
CVE-2026-20977 is a medium severity vulnerability affecting Samsung Mobile Devices involving improper access control in the Emergency Sharing feature prior to the SMR February 2026 Release 1. This flaw allows local attackers to interrupt the functioning of Emergency Sharing without requiring authentication or user interaction. The vulnerability does not impact confidentiality, integrity, or availability beyond the Emergency Sharing service but can disrupt critical emergency communication capabilities. Exploitation requires local access to the device, limiting the attack surface to scenarios where an attacker has physical or local access. No known exploits are currently reported in the wild. European organizations using Samsung Mobile Devices, especially in sectors relying on emergency communication features, should prioritize updating devices once patches are available. Countries with high Samsung mobile market penetration and critical emergency response infrastructure are most likely to be affected. Mitigation involves applying the forthcoming SMR February 2026 Release 1 update and restricting local device access to trusted users. Overall, the vulnerability poses a medium risk due to its limited scope and local attack vector but could impact emergency response reliability if exploited.
CVE-2026-24668 is an improper access control vulnerability in the Open eClass platform versions prior to 4.2. Authenticated students can exploit this flaw to add content to existing course units, an action normally restricted to instructors or administrators. The vulnerability does not affect confidentiality or availability but allows unauthorized modification of course content, impacting data integrity. It requires authentication but no user interaction beyond login, and can be exploited remotely over the network. The issue has been patched in version 4.2. European educational institutions using vulnerable versions are at risk of unauthorized content manipulation, which could undermine course integrity and trust. Mitigation involves upgrading to version 4.2 or later and auditing user permissions.
CVE-2026-24670 is a medium severity improper access control vulnerability in the Open eClass platform versions prior to 4.2. Authenticated students can exploit this flaw to create new course units, a capability normally restricted to privileged roles such as instructors or administrators. This vulnerability does not impact confidentiality or availability but allows unauthorized modification of course content, potentially undermining course integrity. The issue requires authentication but no user interaction beyond login, and it can be exploited remotely over the network. The vulnerability has been patched in version 4.2, and no known exploits are currently reported in the wild. European educational institutions using Open eClass versions before 4.2 should prioritize upgrading to mitigate this risk. Countries with significant adoption of Open eClass or similar academic platforms, such as Greece, Germany, and France, are more likely to be affected.
CVE-2026-1117 is a high-severity vulnerability in the parisneo/lollms software, specifically in the lollms_generation_events.py component. It allows unauthenticated clients to access sensitive Socket. IO events such as generate_text and cancel_generation without any authentication or authorization. This improper access control enables attackers to perform resource-intensive or state-changing operations, potentially causing denial of service, state corruption, and race conditions. The vulnerability is exacerbated by the use of insecure global flags for state management, allowing one client’s actions to impact others. No user interaction or authentication is required to exploit this flaw, making it easily exploitable remotely. The vulnerability impacts the availability and integrity of the service but does not directly affect confidentiality. European organizations using parisneo/lollms are at risk, especially those relying on this software for critical operations. No known exploits are currently reported in the wild.
