CVE-2026-80432

A flaw was found in kitty. An authorization vulnerability allows a program running inside the terminal to access the contents of files dragged over the window, leading to unauthorized information disclosure. This issue occurs because the drag-and-drop handler fulfills file data requests without...

CVE-2026-79005

A flaw was found in Google Chrome's StorageAccessAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-87577

A flaw was found in Chromium. A remote attacker could exploit an authorization vulnerability by creating a specially designed web page. This could allow the attacker to bypass security restrictions, known as the web origin policy, and access sensitive information or functionality on a privileged...

CVE-2026-84399

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

EUVD-2026-86412

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession o...

Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

Vulnerabilities found in Fortinet’s Forti-products

Fortinet has identified vulnerabilities in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM, and FortiSOAR. These vulnerabilities involve various types of errors in multiple Fortinet products. The mos...

WordPress Download Monitor has an authorization vulnerability

WordPress Download Monitor is a powerful free plugin designed specifically for WordPress, used to manage, track, and analyze website file downloads. It supports version control, permission restrictions, and detailed logging. WordPress Download Monitor has an authorization vulnerability that arise...

CVE-2026-72690

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

CVE-2026-72564

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

CVE-2026-48169

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...

Security Bulletin: IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. (CVE-2026-16480)

Summary IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. Vulnerability Details CVEID:CVE-2026-16480 DESCRIPTION: IBM Db2 is affected by an improper authorization...

CVE-2026-17594

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

CVE-2026-17594

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

EUVD-2026-54520

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

CVE-2026-18998

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...

CVE-2026-18992 zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

CVE-2026-70619

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

EUVD-2026-52518

Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction...