EUVD-2026-75060

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier...

CVE-2026-68484

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges...

CVE-2026-67403

Cash Collect (Sage) has an improper authorization vulnerability in the Sage AR Automation API . Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non-predictable tenant identifier. The CVSS ...

EUVD-2026-75061

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges...

CVE-2026-68484

Cash Collect by Sage contains an improper authorization vulnerability in the Sage AR Automation API . Administrative functions fail to properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and escalate to elevated privileges. The issue is ra...

WordPress Advanced Contact form 7 DB plugin <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import vulnerability

Missing Authorization to Authenticated Custom+ Unauthorized Data Import vulnerability discovered by Jiang CY in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.3...

WordPress Builderall for WordPress plugin <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Meta Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

CVE-2026-86773

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-86763

Snipe-IT versions = 7.0.12 and = 8.6.3 contain an authorization bypass in the Livewire importer component App\Livewire\Importer, mounted at the imports.index route. The component only checked the broad 'import' ability at mount time, while its files and activeFile computed properties queried the...

CVE-2026-86765

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86758

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86760

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

CVE-2026-86757

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read...

CVE-2026-86761

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users,...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86750

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

CVE-2026-86752

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86747

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-86746

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

Vulnerabilities in Adobe Experience Manager

Adobe has identified several vulnerabilities in Adobe Experience Manager. Adobe Experience Manager contains several Cross-Site Scripting XSS vulnerabilities, including DOM-based and stored XSS vulnerabilities. These vulnerabilities allow attackers to inject and execute malicious JavaScript code...