PT-2026-108858

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

PT-2026-108886

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1...

PT-2026-108879

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8...

PT-2026-108878

Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1...

CVE-2026-107399

A flaw was found in mechanize. When automatic meta refresh following is enabled, the library fails to restrict request headers across different web domains during a redirect. A remote attacker who controls web content during a crawl can redirect requests to an untrusted destination, leading to...

salt-security-backports

以前のバージョンの公式パッチは以下でリクエストできます: https://www.saltstack.com/lp/request-patch-april-2020/ ⚠ ここのパッチはカスタムであり、公式のものとは異なる場合があります ⚠ サポートされていない Salt バージョン向けのバックポートされたセキュリティパッチ このリポジトリのパッチは以下の CVE に対応しています: CVE-2020-11651 および CVE-2020-11652 - https://labs.f-secure.com/advisories/saltstack-authorization-bypass...

pv2-victim

pv2-victim authz リサーチ - CVE-2026-3306 修正カバレッジ...

CVE-2026-94510

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-83947

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

CVE-2026-105672

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without...

CVE-2026-107728

A flaw was found in strawberry-graphql. When evaluating permissions on synchronous field resolvers, the library fails to properly await asynchronous permission check results and treats the resulting objects as inherently valid. A remote attacker can exploit this flaw to bypass authorization check...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus ≤ 2.0.8 — 缺少授权导致已认证（订阅者+）站点重置和权限提升 CVE-2025-14364 — Demo Importer Plus · 全站重置 → 权限提升 / \ / | / \ | /| || | || \ / | / / / | | | | 已认证的订阅者 → 管理员，通过do-reinstall AJAX 动作 〔 1 〕 漏洞 | ---|--- CVE| CVE-2025-14364 CVSS v3.1| 8.8 高 —...

CVE-2026-107232

A flaw was found in AsyncHttpClient. When an HTTP proxy rejects a connection tunnel request, the client mistakenly assumes that an encrypted tunnel was established. Subsequent redirect or authentication handlers then transmit the original request and its Authorization headers over the plaintext...

CVE-2026-106323

A missing authorization flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553114676...

CVE-2026-105672

The TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability within the HTTPS JSON API dispatcher on TCP port 443. An attacker located on the adjacent network can exploit this by appending an onboarding-scoped object to a JSON request, effectively bypassing session ve...

CVE-2026-107793

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's...

CVE-2026-107792

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-107725

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member...

DEBIAN-CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

CVE-2026-94510

A vulnerability in Microsoft Bookings allows an unauthorized attacker to achieve elevation of privilege over a network. The root cause is an authorization bypass occurring through a user-controlled key . The impact is classified as CRITICAL , with a CVSS 3.1 base score of 9.9 , specifically affec...