Xbox Gaming Services Elevation of Privilege Vulnerability

Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

Improper Authorization io.netty:netty-handler Dependency in Bitbucket Data Center

This High severity Improper Authorization vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

CVE-2026-86342

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...

CVE-2026-86342 MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...

ROS-20260907-73-0050

The vulnerability of the Erlang programming language is related to improper authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential data and influence its integrity...

CVE-2026-86212

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-86212 Open5GS AMF/MME improper authorization

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-86212

Open5GS 2.7.7/2.8.0 is affected by an improper authorization vulnerability in the AMF/MME component. The flaw allows a remote attacker with low privileges to manipulate authorization checks, resulting in a low availability impact (no confidentiality or integrity impact). A proof-of-concept exploi...

EUVD-2026-72103

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-86212 Open5GS AMF/MME improper authorization

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-85038

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

Exploit for Improper Authorization in Vercel Next.Js

CVE-2025-29927 – Next.js Middleware Authorization Bypass Verif...

PT-2026-86359

🚨 CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbound...

CVE-2026-18175

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...

CVE-2026-17627

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...

CVE-2026-16941

IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization...

CVE-2026-16941

IBM i versions 7.6, 7.5, and 7.4 (license product 5770-SS1 ) are affected by an incorrect authorization flaw (CWE-863 ) that allows a remote authenticated attacker to modify certain system messages , resulting in a limited integrity impact (CVSS 4.3, MEDIUM). No confidentiality or availability im...

EUVD-2026-71483

IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization...

EUVD-2026-71466

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...

CVE-2026-17627

IBM Langflow OSS (versions 1.0.0–1.10.2) is affected by an improper authorization flaw (CWE-639) in its voice-mode WebSocket endpoint . The endpoint authenticates the connecting user but performs no check to verify that the user is permitted to access the specified flow identifier. In a multi-use...