PT-2026-93854

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.3 Description The REST API user creation endpoint 'POST /ccm/api/1.0/users', specifically the add function in concrete/src/Api/Controller/Users.php, fails to perform a permission check before creating an...

CVE-2026-92771: Incorrect Authorization

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

PT-2026-93705

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description A missing authorization issue exists in the 'GET /admin-api/crm/flow/flow-users' endpoint. This allows any authenticated back-office user to access sensitive approval workflow data, including...

CVE-2026-92585: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-92461: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

CVE-2026-92458: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...

CVE-2026-92457: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify...

CVE-2026-92601: Missing Authorization

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...

PT-2026-93733

Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions prior to 6.0.1 Description An unverified password change issue exists in the 'PUT /users/password' endpoint. Authenticated users can change the password of any non-administrator account by omitting the...

PT-2026-93951

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description A flaw in the web-based management interface allows an authenticated remote attacker to obtain sensitive information from network users belonging to security groups other than the one...

CVE-2026-92586: Missing Authorization

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

PT-2026-93707

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description An authorization failure exists in the 'GET /admin-api/system/user/page' endpoint because the @PreAuthorize annotation is commented out. This allows authenticated back-office users who lack the...

CVE-2026-92463: Missing Authorization

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

PT-2026-93308

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

PT-2026-94040

Name of the Vulnerable Software and Affected Versions PatrowlManager versions prior to 1.8.5 Description Improper access control exists in the user listing API endpoint because the authorization decorator is commented out. This allows authenticated attackers with low-privilege accounts to enumera...

PT-2026-93748

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.18.1 Description The ListUsers API could incorrectly return a user who should have been excluded. This occurs when an authorization relation uses an intersection containing a base but not excluded operand, the base ...

CVE-2026-92467: Unverified Password Change

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...

CVE-2026-76863 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the modqosbandwidth plan.json handling within filterconnsdumpcgi.c and IGDCgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their...

CVE-2026-92234

QloApps versions through 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page (back-office). The child_features parameter is reflected unescaped into validation error messages, allowing an authenticated back-office user who fol...

EUVD-2026-78916

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...