Base de CVEs

CVE-2026-74929 Média · 5.4 CWE-284 26/08/2026

WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.

CVE-2026-16986 Média · 5.3 CWE-284 26/08/2026

Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.

CVE-2026-16984 Média · 6.5 CWE-284 26/08/2026

WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.

CVE-2026-65182 Crítica · 9.1 CWE-284 25/08/2026

Apache Tomcat: Bypass longest prefix security constraint

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

CVE-2026-38474 Média · 5.4 CWE-284 25/08/2026

GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers…

GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.

CVE-2026-38470 Média · 4.3 CWE-284 25/08/2026

A Broken access control vulnerability in the API user endpoint in GazellePW…

A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created API token.

CVE-2026-79201 Média · 4.3 CWE-284 25/08/2026

Improper Access Control em Google Chrome

Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-75465 Alta · 7.5 CWE-284 25/08/2026

The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an…

The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.

CVE-2026-55536 Crítica · 9.1 CWE-284 25/08/2026

Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.

CVE-2026-77997 Média · 5.1 CWE-284 25/08/2026

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with com_template editing permissions to access information about arbitrary modules without the respective com_modules permissions.

CVE-2026-61419 Alta · 7.8 CWE-284 24/08/2026

Improper Access Control em Dell Thinos

Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

CVE-2026-78245 Alta · 7.3 CWE-284 24/08/2026

itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

CVE-2026-78202 Alta · 7.3 CWE-284 24/08/2026

itsourcecode Payroll System admin_class.php save_settings unrestricted upload

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

CVE-2026-76609 Média · 6.9 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.

CVE-2026-76608 Média · 6.9 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks.

CVE-2026-76607 Crítica · 10.0 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.

CVE-2026-76603 Média · 6.9 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users.

CVE-2026-76601 Média · 6.9 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.

CVE-2026-76600 Média · 6.9 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks.

CVE-2026-76599 Alta · 8.7 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns.

CVE-2026-76597 Alta · 8.7 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.

CVE-2026-76596 Alta · 8.7 CWE-284 22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table

CVE-2026-65915 Média · 6.5 CWE-284 22/08/2026

NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

CVE-2026-66916 Média · 6.9 CWE-284 22/08/2026

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.

CVE-2026-16738 Média · 5.3 CWE-284 22/08/2026

Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.