CVE-2026-17627

IBM Langflow OSS (versions 1.0.0–1.10.2) is affected by an improper authorization flaw (CWE-639) in its voice-mode WebSocket endpoint . The endpoint authenticates the connecting user but performs no check to verify that the user is permitted to access the specified flow identifier. In a multi-use...

CVE-2026-18175

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by an improper authorization flaw (CWE-285) in the DDM target dispatcher component of Distributed Data Management. A remote attacker with no prior access could manipulate database transactions , resulting in high integrity impact and low confiden...

CVE-2026-18175 IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...

EUVD-2026-71458

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

EUVD-2026-70807

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARECMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARECMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary address...

EUVD-2026-70817

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

PT-2026-85775

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...

Fedora 43 : chromium (2026-ee60d45695)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee60d45695 advisory. - Update to 152.0.7977.75 CVE-2026-84353: Use after free in Shared Tab Groups CVE-2026-84352: Use after free in WebGL CVE-2026-84354: Incorrect...

CVE-2026-85433

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARECMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARECMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary address...

CVE-2026-85241

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

CVE-2026-85241 SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

CVE-2026-85241

SpecterOps BloodHound versions up to 9.5.1 are affected by an improper authorization flaw in the Graph Write Endpoint , specifically in the function NewV2API located in cmd/api/src/api/registration/v2.go. A remote attacker with low privileges can manipulate this endpoint, resulting in low impacts...

CVE-2026-85241 SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

Security Bulletin: Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2026-11927 DESCRIPTION: IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

Security Bulletin: IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [CVE-2026-18175, CVE-2026-18221]

Summary IBM i is vulnerable to manipulation of database transactions due to improper authorization CVE-2026-18175 and allowing unathorized access due to improper validation CVE-2026-18221 in Distributed Data Management DDM / Distributed Relational Database Architecture DRDA as described in the...

GO-2026-6329 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets in github.com/seaweedfs/seaweedfs

SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets in github.com/seaweedfs/seaweedfs...

CVE-2026-84806

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

EUVD-2026-69919

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...