CVE-2026-89013

Dolibarr (ERP/CRM) versions 23.0.4 before 24.0.1 contains an authorization bypass in its document storage endpoints (htdocs/document.php and htdocs/viewimage.php). By sending a request with the crafted parameter hashp=shared , an unauthenticated attacker can skip token validation while still sati...

EUVD-2026-76144

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-8304 Information Disclosure in TUBITAK BILGEM's Pardus About

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5...

EUVD-2026-76140

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5...

CVE-2026-8304

CVE-2026-8304 is a Missing Authorization vulnerability in Pardus About by TUBITAK BILGEM Software Technologies Research Institute, caused by incorrectly configured access control security levels. This allows a local attacker with low privileges to achieve high confidentiality impact (information ...

CVE-2026-89265

MoguBlog through 6.2 contains an authorization bypass in the admin endpoint POST /pictureSort/getPictureSortByUid , which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid ...

CVE-2026-89265 MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a catego...

EUVD-2026-76138

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a catego...

CVE-2026-89262

MoguBlog through 6.2 contains an authorization bypass (IDOR) in its comment deletion endpoint. The root cause is that ownership checks are performed against request-body fields rather than the authenticated principal, allowing an unauthenticated attacker to delete arbitrary comments and their rep...

EUVD-2026-76135

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...

CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...

secdim-assurance-drift-challenge

SecDim Challenge Builder Repro — Deriva de garantía Reproducción funcional para un desafío de seguridad propuesto inspirado en CVE-2026-88861 , publicado el 10 de septiembre de 2026. Concepto de seguridad La aplicación verifica correctamente una sesión firmada y comprueba correctamente el rol...

CVE-2026-38056

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0 , a rackmount satellite modem used as the primary communications link for offshore rigs, vessels, and remote sites. The device ships with a pre-configured low-privilege local user accoun...

CVE-2022-22978

CVE-2022-22978: Bypass de autorización de Spring Security Resumen Spring Security es un framework de seguridad que proporciona autenticación y autorización en aplicaciones basadas en Spring. En Spring Security 5.5.6, 5.6.3 y versiones anteriores, al usar RegexRequestMatcher, una funcionalidad que...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner A non-intrusive, version-based vulnerability scanner for CVE-2026-4282 , affecting Keycloak and Red Hat Build of Keycloak RHBK. ⚠️ Disclaimer: This tool is intended strictly for authorized security research, penetration testing, and defensive vulnerability management. Only ru...

CVE-2026-89248

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

gstreamer1-plugins-base security update

An update is available for gstreamer1-plugins-base. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...

CVE-2026-82213

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

CVE-2026-89252

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in addLiveLink.php when updating LiveLinks. The component fails to verify ownership, allowing any authenticated canStream user to overwrite another user's LiveLink HLS source and metadata...

CVE-2026-89251 AVideo Missing Authorization via AD_Server log.php Wallet Credit

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...