PT-2026-86224

Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem Management interface affected versions not specified Description A missing authorization issue in the management interface allows a user with Admin privileges to escalate their permissions to...

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-79747

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...

CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...

CVE-2026-79747 MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...

PT-2026-78740

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can achieve Remote Code...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53453

Blueprint Studio (a Home Assistant config editor) failed to enforce its admin-only authorization boundary prior to v2.5.2, allowing any authenticated non-admin user to invoke arbitrary services, modify config files, expose state, upload files, and reach terminal helpers, compromising CIA of the i...

CVE-2026-64859

In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...

CVE-2026-11970

This vulnerability allows a normal non-admin user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758...

CVE-2026-24329

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

CVE-2026-14526 AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...

GHSA-9P7C-V5X3-RFX8 Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

The reorder-sets action in Craft CMS’s GlobalsController is missing the requireAdmin check that the adjacent save-set and delete-set actions both enforce. Any authenticated control panel user can POST to /actions/globals/reorder-sets and permanently reorder all global sets in the project config,...

CVE-2026-7327

The CVE covers Progress MarkLogic Server REST API: an improper privilege management in the REST API document processing pipeline allows an authenticated user with an administrative REST role to escalate privileges, potentially exposing sensitive server-side data. Affected versions are MarkLogic S...

CVE-2026-70491

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

CVE-2026-17568

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

EUVD-2026-49377

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...