PT-2026-90542

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse access setting permission, without being an admin and without a...

PT-2026-90544

Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only view users permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...

PT-2026-89785

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

Linux Distros Unpatched Vulnerability : CVE-2026-87107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-import...

PT-2026-90502

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

PT-2026-90519

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

PT-2026-90494

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as hero image and gallery, is where the referenced file is authorized against the user's file-manager...

PT-2026-90515

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

PT-2026-90541

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

PT-2026-90546

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

PT-2026-90545

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

PT-2026-90543

Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...

FreeBSD : immich -- locked assets remain accessible through shared albums and links (fcc6917b-adbc-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fcc6917b-adbc-11f1-a655-3497f65b111b advisory. NVD reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are...

UBUNTU-CVE-2026-87107

Consul and Consul Enterprise are vulnerable to an authorization bypass...

POC-CVE-2023-32681

POC para CVE-2023-32681 Esta es una implementación en Python 3 de CVE-2023-32681, que afecta a clientes que usan requests versión = 2.30.0. Según https://www.rfc-editor.org/rfc/rfc9110.htmlsection-15.4, cuando el servidor emite una redirección 3xx, el agente de usuario debe modificar la solicitud...

salt-security-backports

Se pueden solicitar parches oficiales para versiones anteriores en: https://www.saltstack.com/lp/request-patch-april-2020/ ⚠ Los parches aquí son personalizados y pueden diferir de los oficiales ⚠ Parches de seguridad retroportados para versiones no compatibles de Salt Los parches en este...

axios: Axios: Information disclosure of proxy credentials via HTTP redirects

A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can...

pv2-victim

pv2-victim investigación de authz - cobertura de la corrección de CVE-2026-3306...

CVE-2026-18121 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...

CVE-2026-18121

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}). The controller loads the event occurrence from an attacker-supplied sequential identifier without verifying that the caller ...