PT-2026-96206

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An authorization check is missing on the 'POST /userBusiness/updateBtnStr' endpoint, allowing authenticated users to modify role button-permission definitions. An attacker can provide arbitrary roleId a...

PT-2026-96306

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description An authorization bypass exists in the 'getUserInfoById' endpoint. This flaw allows authenticated users to access the full profiles of other users by iterating the userId parameter. This can lead ...

CVE-2026-94218: Missing Authorization

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

PT-2026-96059

Name of the Vulnerable Software and Affected Versions To Do List Member WordPress plugin versions prior to 1.7 Description An import routine lacks authorization and nonce checks, and fails to validate the source location of fetched data. This allows unauthenticated users to create arbitrary...

PT-2026-96098

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE AGENT can enumerate saved reply identifiers and read content reserved for groups...

PT-2026-96307

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description An authorization bypass exists in the FileAnyoneController that allows authenticated users to download arbitrary attachments. By providing valid attachment identifiers to the '/anyone/file/down'...

PT-2026-96048

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the User-Managed Access UMA implementation. The issue occurs at the authorization token endpoint when processing permission tickets. If two different users own resources wit...

PT-2026-96253

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.0.0 through 2.10.2-lts Description An authorization flaw exists in the document and paragraph operation routes. The system validates the knowledge id in the request path but fails to verify if the target Document, identified b...

PT-2026-96055

Name of the Vulnerable Software and Affected Versions Omega Solution FBP Fulfillment by People 2025 Description An authorization bypass exists within the User Profile API component in the /user/ file. Remote exploitation is possible by manipulating the ID argument, allowing an attacker to bypass...

PT-2026-96183

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authorization flaw exists in the HandleWipeInventory function within the backend/app/api/handlers/v1/v1 ctrl actions.go file. The system authorizes the 'POST /v1/actions/wipe-inventory' endpoint...

PT-2026-96211

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An authorization bypass exists in the userBusiness CRUD endpoints. This issue allows authenticated users to create, modify, or delete authorization-relation rows because the system fails to perform...

CVE-2026-73553: Interpretation Conflict

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

ROS-20260921-73-0072

The vulnerability in the incus is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

PT-2026-96120

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.3.0 through 3.3.1 Description An issue exists in the Airflow core API where the system incorrectly prioritizes a session cookie over an explicit Authorization: Bearer token when both are present in a request. This...

PT-2026-96113

Name of the Vulnerable Software and Affected Versions pki-core affected versions not specified Description A flaw in the v2 REST ACL filter occurs when the system selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison instead of...

Linux Distros Unpatched Vulnerability : CVE-2026-93852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an...

Linux Distros Unpatched Vulnerability : CVE-2026-93854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and...

CVE-2026-94394: Missing Authorization

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

PT-2026-96309

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description An authorization bypass exists that allows authenticated users to delete notifications belonging to other users. This occurs because the system fails to validate the recipient when processing...

SUSE SLES15 Security Update : terraform-provider-null (SUSE-SU-2026:4062-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4062-1 advisory. - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies vi...