Broken-Access-Control

MISP Core `deleteSelection` Broken Access Control — Bulk Deletion of Foreign Event Reports & Sharing Groups (CVE-2026-56423) newCVE-2026-56423webHIGH 8.8Patched2026-07-27Frontend Admin by DynamiApps — Unauthenticated Administrator Account Creation (CVE-2025-13342) newCVE-2025-13342webCRITICAL 9.8Patched2026-07-06YAMCS Unauthorized User Enumeration via IAM API (CVE-2026-44595) newCVE-2026-44595 / GHSA-p2rj-mrmc-9w29webMEDIUM 4.3Patched2026-07-05WooCommerce Frontend Registration Form Unauthenticated Admin Role Assignment — CVE-2026-54807 newCVE-2026-54807webINFOUnverified2026-07-05Simple History Missing Authorization Account Takeover — CVE-2026-7459 newCVE-2026-7459webHIGH 7.5Unverified2026-07-05Masteriyo LMS Authenticated Privilege Escalation to Administrator (CVE-2026-4484) newCVE-2026-4484webHIGH 8.8Unverified2026-07-05LiteLLM Proxy Privilege Escalation via `/user/update` (CVE-2026-47102) newCVE-2026-47102webHIGH 8.8Patched2026-07-05LiteLLM /config/update Broken Access Control (CVE-2026-35029) new EPSS 26%CVE-2026-35029webHIGH 8.8Patched2026-07-05Grafana Dashboard Permissions Broken Access Control — Editor-to-Admin Privilege Escalation (CVE-2026-21721) newCVE-2026-21721webHIGHPatched2026-07-05GitLab WebSocket GraphqlChannel Unauthorized Method Enumeration — CVE-2026-5173 newCVE-2026-5173webHIGHPatched2026-07-05Eventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776) newCVE-2026-40776 / Patchstack PSID 85de025d71e7webHIGH 7.5Patched2026-07-05Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415 newCVE-2026-54415webHIGH 3.1Patched2026-07-05