Base de CVEs

CVE-2026-105876 Média · 5.3 CWE-862 07/10/2026

WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.

CVE-2026-104390 Média · 4.3 CWE-862 07/10/2026

WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.

CVE-2026-103075 Média · 4.3 CWE-862 07/10/2026

WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.

CVE-2026-93026 Média · 6.1 CWE-862 07/10/2026

Missing Authorization em Veeam Backup and Replication

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

CVE-2026-58068 Média · 6.8 CWE-862 07/10/2026

Missing Authorization em Veeam Veeam Agent For Windows

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.

CVE-2026-82211 Alta · 8.2 CWE-862 07/10/2026

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

CVE-2026-103323 Média · 5.9 CWE-862 07/10/2026

Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.

CVE-2026-81535 Crítica · 9.1 CWE-862 07/10/2026

wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.

CVE-2026-102410 Média · 4.3 CWE-862 06/10/2026

Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

CVE-2026-56952 Média · 6.7 CWE-862 06/10/2026

Missing Authorization em Google Android

In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-106425 Média · 4.2 CWE-862 06/10/2026