EUVD-2026-80813

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...

CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-92467 microservices-platform through 6.0.0 Unverified Password Change via /users/password

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...

CVE-2026-88817 Privilege escalation via legacy access group creation endpoint

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...

CVE-2026-92462

yshop-crm through version 2.1.3 is vulnerable to a missing authorization flaw in the CrmFlowController deleteFlowStep endpoint (DELETE /admin-api/crm/flow/delete-step). Any authenticated back-office user can invoke this endpoint without the required permissions to delete arbitrary approval workfl...

EUVD-2026-80665

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92455

CVE-2026-92455 affects yshop-crm through 2.1.3 , where the sendSms and sendMail endpoints in CrmCustomerController lack proper authorization enforcement. This allows any authenticated back-office user to invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with ...

CVE-2026-19640

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-19640 Security Advisory 0170

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-73439 Security Advisory 0164

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule fo...

CVE-2026-78252

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

EUVD-2026-80121

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cau...

CVE-2026-8030 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-78252

GitLab CE/EE versions from 15.3 before 19.1.8 , 19.2 before 19.2.6 , and 19.3 before 19.3.2 are affected by improper sanitization of user-controlled data in the Markdown JSON table renderer . Under certain conditions, an authenticated user could induce a targeted user to perform unintended state-...

EUVD-2026-80222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-8030: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

GitLab 15.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-13210)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...

PT-2026-93275

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

PT-2026-93328

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.3 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An authenticated user can induce a targeted user to perform unintended state-changing HTTP requests. This...

CVE-2026-74926: Missing Authorization

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...