CVE-2026-76910

The open-source feature management platform Unleash (versions prior to 8.0.3 ) is vulnerable to an authorization bypass in the cloneFeatureToggle function and the POST /api/admin/projects/:projectId/features/:featureName/clone endpoint. The root cause is that the system validates permissions for ...

EUVD-2026-84861

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-77252

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, caller-supplied projectsfilter and spacesfilter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured...

CVE-2026-18462

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

EUVD-2026-84617

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

CVE-2026-18462

The RTI Connext Professional (Core Libraries) software is vulnerable to an Integer Overflow or Wraparound and Improper Access Control vulnerability. This flaw allows for Shared Resource Manipulation and affects specific versions: 7.4.0 before 7.7.0.1 , 7.0.0 before 7.3.1.6 , and *6.1.0 before 6.1...

WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Manager versions = 2.9.19...

CVE-2026-95685

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...

EUVD-2026-84424

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .

Summary IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat. The Tomcat version has been updated within IBM ApplinX in order to address the mentioned vulnerabilities. Vulnerability Detail...

Security Bulletin: Vulnerabilities in IBM SDK, Java Technology (CVE-2026-16440, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589) affect Power PowerVM Novalink

Summary The IBM SDK, Java Technology used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

ROS-20260922-73-0077

The vulnerability in Tomcat11 is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20260922-73-0076

The vulnerability in Tomcat10 is related to access control deficiencies. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2026-76709: Improper Access Control

A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...

CVE-2026-77252: Improper Access Control

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, caller-supplied projectsfilter and spacesfilter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured...