PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

PT-2026-82653

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description An improper access control issue exists within the ServiceNow AI platform. This flaw allows an unauthenticated user to create or modify instance data beyond intended permission...

PT-2026-82766

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances SV-100E and SV-300E series and Synergis Softwire installed on Windows servers...

CVE-2026-37067

CVE-2026-37067 is an incorrect access control flaw in the file /vfm-admin/admin-panel/view/save-cvs.php of Veno File Manager Project 4.4.9 . An unauthenticated attacker can send a specially crafted POST request to extract all application logs from a chosen date forward, resulting in a low confide...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

CVE-2026-69129

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-77298

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129

KubePi , a Kubernetes multi-cluster management panel by 1Panel-dev, contains an authorization flaw in versions up to and including 2.0.0 . Cluster-scoped APIs do not consistently validate per-cluster access, meaning an authenticated user granted management rights over one cluster can, under certa...

CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2024-46627

CVE-2024-46627 - Controllo di accesso errato in BECN DATAGERRY v2.2 consente agli attaccanti di eseguire comandi arbitrari tramite richieste web appositamente create. DATAGERRY v2.2 non dispone di controllo degli accessi nella REST API per i seguenti endpoint: /rest/users//settings/ GET, POST...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-62249

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-55228

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-55227

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

CVE-2026-62249

Weblate , a web-based continuous localization platform, is affected by an access-control bypass in its nested API change endpoints (GET /api/projects/{slug}/changes/). In versions prior to 2026.7 , an authenticated user with project-level access can retrieve the change history of restricted compo...

CVE-2026-62249 Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-66003

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...