CVE-2026-92462: Missing Authorization

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

PT-2026-94060

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.11.1 Description Insufficient validation of caller permissions in the 'DELETE /api/v2/rbac/id' endpoint allows users with read access to delete access control relationships. This can enable attackers to revoke the...

CVE-2026-27560: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93735

Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions prior to 6.0.0 Description An authorization bypass exists in the file-center module. The 'DELETE /files/id' endpoint fails to perform ownership validation, allowing authenticated attackers to delete file...

CVE-2026-92753: Missing Authorization

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users...

CVE-2026-92469: Authorization Bypass Through User-Controlled Key

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92603: Authorization Bypass Through User-Controlled Key

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message r...

PT-2026-93670

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the realtek cr USB storage component. The realtek cr destructor function calls timer delete before the chip containing the timer is freed. This allows th...

PT-2026-93489

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the qla2xxx driver. The function qla2xxx delete qpair deletes the request queue before the response queue. Because qla25xx delete req que frees the reque...

PT-2026-93589

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv BLA Border Gateway Advertisement component during the deletion of a mesh interface. The function batadv bla del backbone claims called via batadv bla...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38413)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the delWiFiScheduleCfg function. Attackers can exploit this vulnerability by sending specially crafted POST request...

EUVD-2026-79026

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

CVE-2026-68532: Cross-Site Request Forgery (CSRF)

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

CVE-2026-83431: Improper Authorization

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite component: WebUI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successf...

PT-2026-92374

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.0.0 Description The dashboard group type controller fails to validate a CSRF Cross-Site Request Forgery token during its delete action. This allows a remote unauthenticated attacker to trick an authenticat...

PT-2026-91855

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-54050: Authorization Bypass Through User-Controlled Key

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

PT-2026-91869

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to t...