CVE-2026-69190: Authorization Bypass Through User-Controlled Key

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. Th...

CVE-2026-80110: Incorrect Authorization

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

CVE-2026-63342: Incorrect Authorization

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-77520: Missing Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...

PT-2026-96253

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.0.0 through 2.10.2-lts Description An authorization flaw exists in the document and paragraph operation routes. The system validates the knowledge id in the request path but fails to verify if the target Document, identified b...

PT-2026-96113

Name of the Vulnerable Software and Affected Versions pki-core affected versions not specified Description A flaw in the v2 REST ACL filter occurs when the system selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison instead of...

CVE-2026-77518: Missing Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

CVE-2026-77525: Missing Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path applicationid but load records using global chatid and chatrecordid values without confirming that the chat belongs to the authorized application. A normal user in the...

CVE-2026-52743: Authorization Bypass Through User-Controlled Key

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the us...

CVE-2026-77516: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through toolids, skilltoolids, or mcptoolids and execute it through the agent or workflow...

CVE-2026-63116: Missing Authorization

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

PT-2026-96048

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the User-Managed Access UMA implementation. The issue occurs at the authorization token endpoint when processing permission tickets. If two different users own resources wit...

CVE-2026-94217: Missing Authorization

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...

CVE-2026-73553: Interpretation Conflict

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

CVE-2026-77523: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspaceid in the query. An authenticated user with model rea...

CVE-2026-94218: Missing Authorization

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

CVE-2026-94494: Authorization Bypass Through User-Controlled Key

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

CVE-2026-77517: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledgeid in the request path, then query the target Document by documentid or Paragraph by paragraphid without confirming that the object belongs to...

PT-2026-96204

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An authorization bypass exists in the 'POST /user/resetPwd' endpoint. This flaw allows authenticated users to reset the password of any other user, including administrators, by submitting a request with...

CVE-2026-94501: Missing Authorization

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate...