Base de CVEs

CVE-2026-71307 Alta · 7.7 CWE-862 18/08/2026

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.

CVE-2026-67443 Crítica · 9.2 CWE-862 18/08/2026

FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.

CVE-2026-67440 Média · 6.9 CWE-862 18/08/2026

FUXA: Unauthenticated Socket.IO read events

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.

CVE-2026-47721 Média · 6.3 CWE-862 18/08/2026

FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.

CVE-2026-65959 Média · 5.3 CWE-862 18/08/2026

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

CVE-2026-67262 Alta · 8.1 CWE-862 18/08/2026

Missing Authorization em Dell PowerStore 500T

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass.

CVE-2026-55106 Média · 5.3 CWE-862 18/08/2026

authentik: Unauthenticated LDAP directory data disclosure

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

CVE-2026-45124 Média · 4.3 CWE-862 18/08/2026

MyBB: Mod CP report resolution missing authorization

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.

CVE-2026-74006 Média · 4.3 CWE-862 18/08/2026

WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

CVE-2026-74004 Média · 5.4 CWE-862 18/08/2026

WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.

CVE-2026-74003 Média · 4.3 CWE-862 18/08/2026

WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.

CVE-2026-73994 Alta · 7.5 CWE-862 18/08/2026

WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

CVE-2026-73404 Média · 6.5 CWE-862 18/08/2026

WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.

CVE-2026-73377 Alta · 7.5 CWE-862 18/08/2026

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

CVE-2026-73356 Alta · 8.2 CWE-862 18/08/2026

WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

CVE-2026-73352 Média · 6.5 CWE-862 18/08/2026

WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

CVE-2026-73348 Média · 6.5 CWE-862 18/08/2026

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

CVE-2026-66651 Média · 6.5 CWE-862 18/08/2026

WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20.

CVE-2026-32549 Alta · 7.5 CWE-862 18/08/2026

WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

CVE-2026-32472 Alta · 7.5 CWE-862 18/08/2026

WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

CVE-2026-28571 Alta · 7.5 CWE-862 18/08/2026

WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

CVE-2026-28567 Alta · 7.5 CWE-862 18/08/2026

WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

CVE-2026-75853 Alta · 8.8 CWE-862 18/08/2026

ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.

CVE-2026-75850 Média · 4.2 CWE-862 18/08/2026

ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected.

CVE-2026-75846 Alta · 7.1 CWE-862 18/08/2026

ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase (UPDATE_SCHEMA) check. Any user with database access can execute DELETE FUNCTION via the command API (POST /api/v1/command/{db}) to permanently remove any registered server-side function, including security-relevant logic, impacting integrity and availability.