CVE-2026-6062 IDOR in Jira plugin subscription edit endpoint

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT...

CVE-2026-48772

A flaw was found in ProxySQL, a proxy for MySQL and its forks, as well as PostgreSQL. A remote attacker can exploit this vulnerability by sending a specially crafted PROXY protocol version 1 PP1 header with an 'UNKNOWN' protocol token. Despite the specification requiring these address fields to b...

CVE-2026-56424 Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could...

CVE-2026-56424 Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could...

CVE-2026-56423 MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports,...

CVE-2026-56423 MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports,...

WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by nobody09 in WordPress Plugin User Registration versions = 5.2.2...

Exploit for Improper Access Control in Widgetfactorylimited Jce

No d...

PT-2026-51452

Name of the Vulnerable Software and Affected Versions Budibase versions 3.37.2 through 3.38.x Description Budibase contains an issue where the GET /api/chat-links/:instance/:token/handoff endpoint is public and lacks authentication and Cross-Site Request Forgery CSRF protection. This allows an...

ROS-20260622-73-0008

The vulnerability of the WebRender component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

OpenClaw Limited licensing and access control issues

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has vulnerabilities related to limited permissions and access control. Attackers can exploit these vulnerabilities to replay the bootstrap token before it is approved, thereby increasing the paired...

PT-2026-51307

Name of the Vulnerable Software and Affected Versions MISP Core affected versions not specified Description Broken access-control checks exist in the bulk deletion flows for Event Reports and Sharing Groups. The deleteSelection handlers authorized deletions using broad role-level permissions...

The vulnerability of the Netmonitor component affects browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird, allowing attackers to escalate their privileges.

The vulnerability of the Netmonitor component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

OpenClaw input validation error vulnerability (CNVD-2026-26890)

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has a vulnerability related to input validation. An attacker can exploit this vulnerability to match allowed list entries based on dialogue metadata rather than a stable sender identity. This allows them t...

Microsoft Azure Synapse permission licensing and access control issue vulnerabilities

Microsoft Azure Synapse is a cloud data analysis service provided by the American company Microsoft. There are vulnerabilities related to permission licensing and access control in Microsoft Azure Synapse. These vulnerabilities stem from issues with privilege escalation; attackers can exploit the...

OpenClaw permission licensing and access control vulnerabilities (CNVD-2026-26891)

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has vulnerabilities related to permission management and access control. These vulnerabilities stem from environmental variable injection issues. The .env STATEDIRECTORY environment variable may affect the...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attrsetsize errors when truncating files CVE-2025-71289 In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl...

OpenClaw input validation vulnerability

OpenClaw is an intelligent artificial assistant open-sourced by the OpenClaw team. OpenClaw has a input validation vulnerability. An attacker can exploit this vulnerability to trigger incorrect group policy decisions when providing group IDs to the policy resolver, thereby bypassing the intended...

CVE-2026-56253

Capgo before 12.128.2 contains an improper access control vulnerability in the public.getorgmembers RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sbpublishable key and an organization UUID to retrieve...

CVE-2026-56253 Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC

Capgo before 12.128.2 contains an improper access control vulnerability in the public.getorgmembers RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sbpublishable key and an organization UUID to retrieve...