CVE-2026-82062

MongoDB Server is affected by an improper authorization flaw in the applyOps command . An authenticated user with elevated internal privileges can bypass a disabled feature gate by specifying an internal replication mode value not intended to be client-selectable. This enables container operation...

CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container...

CVE-2026-86840

Bifrost's vtoken-minting and slpx pallets contain an improper authorization flaw: a signed account can supply any registered channel_id when minting tokens without being verified as authorized for that channel. This lets an attacker inflate a channel's recorded mint volume , causing protocol comm...

CVE-2026-86840 Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...

EUVD-2026-72876

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...

Xbox Gaming Services Elevation of Privilege Vulnerability

Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

CVE-2023-22518

CVE-2023-22518 Improper Authorization Vulnerability in Confluence Data Center and Server. Atlassian has alerted administrators about a critical vulnerability in Confluence. Exploiting this issue can lead to data loss, so developers urge you to install patches as soon as possible. It is noted that...

CVE-2026-86342

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...

CVE-2026-86342 MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...

ProjectSend <= r1605 - Improper Authorization

An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to...

CVE-2026-58231

CVE-2026-58231 Detection Script Detection and precondition-verification tool for CVE-2026-58231 — improper authorization in the Data Hub Adapter component of SAP Commerce Cloud CVSS 10.0. The script performs non-destructive checks only. It does not ship or execute any code-injection payload...

CVE-2026-86212

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-86212 Open5GS AMF/MME improper authorization

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-86212

Open5GS 2.7.7/2.8.0 is affected by an improper authorization vulnerability in the AMF/MME component. The flaw allows a remote attacker with low privileges to manipulate authorization checks, resulting in a low availability impact (no confidentiality or integrity impact). A proof-of-concept exploi...

EUVD-2026-72103

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-86212 Open5GS AMF/MME improper authorization

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifie...

CVE-2026-85038

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to...

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — BOLA CVE-2023-27524 Demo Project root@kitploit: 🔐 Broken Object Level Authorization BOLA Demonstration CVE-2023-27524 Security Analysis & Fix --- 📌 Project Overview This project demonstrates a real-world Broken Object Level Authorization BOLA vulnerability and it...

CVE-2026-31309

CVE-2026-31309: Improper Access Control in Mysterium Node before v1.36.0 Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node...

PT-2026-86359

🚨 CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbound...