EUVD-2026-69919

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

EUVD-2026-69918

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-84807

Kimai (kimai/kimai) versions prior to 2.65.0 contain an improper authorization flaw in its default team-creation endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team). An authenticated user holding project permission-management privileges can crea...

CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-84806

Kimai versions before 2.63.0 contain an improper authorization flaw in team access endpoints. Authenticated users holding team edit permissions combined with read-only access can send POST requests to team access endpoints to modify access control lists for customers, projects, or activities beyo...

Improper Authorization io.netty:netty-handler Dependency in Confluence Data Center

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 and a CVSS...

Improper Authorization in Jira Service Management Data Center

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

CVE-2026-81194

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities [CVE-2026-18567, CVE-2026-16660, CVE-2026-17483]

Summary IBM Db2 Mirror for i is affected by multiple vulnerabilities as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18567 DESCRIPTION: IBM Db2 Mirror for i could allow a local attacker to obtain information due to a race condition involving a predictable...

Improper Authorization in Confluence Data Center

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

EUVD-2026-66219

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-66422

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

EUVD-2026-68297

A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such manipulation leads to improper authorization. The attack may be performed from remote. A high complexity level is associated with this attack...

CVE-2026-82594

A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such manipulation leads to improper authorization. The attack may be performed from remote. A high complexity level is associated with this attack...

CVE-2026-82594

LogNet grpc-spring-boot-starter (up to version 5.2.0 ) contains an improper authorization flaw in its Annotation Processing component, exploitable over the network. The specific function affected is described as unknown. The attack requires low privileges and has high complexity , limiting practi...

CVE-2026-82594 LogNet grpc-spring-boot-starter Annotation Processing improper authorization

A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such manipulation leads to improper authorization. The attack may be performed from remote. A high complexity level is associated with this attack...

CVE-2026-82594 LogNet grpc-spring-boot-starter Annotation Processing improper authorization

A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such manipulation leads to improper authorization. The attack may be performed from remote. A high complexity level is associated with this attack...

CVE-2026-82553

A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqliquery of the file studentdashboard.php of the component Student Dashboard. The manipulation of the argument rollno results in improper...

CVE-2026-82553 sambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization

A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqliquery of the file studentdashboard.php of the component Student Dashboard. The manipulation of the argument rollno results in improper...