113018 matches found
PT-2026-97336
Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.22.2 Description An authorization bypass exists in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The system only verifies the collection-level edit posts capability and the post author, failing...
GitLab 19.1 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92529)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated...
Linux Distros Unpatched Vulnerability : CVE-2026-95292
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Safebrowsing. CVE-2026-95292 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...
CVE-2026-95848: Not Failing Securely
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...
CVE-2026-85724: Incorrect Authorization
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...
PT-2026-97399
Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description When a configured authenticator or authorizator class cannot be loaded, the Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy functions treat the failure as if no custom class...
Linux Distros Unpatched Vulnerability : CVE-2026-95300
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access...
GitLab 18.3 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92874)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...
Linux Distros Unpatched Vulnerability : CVE-2026-95290
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access...
Linux Distros Unpatched Vulnerability : CVE-2026-95320
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address...
Linux Distros Unpatched Vulnerability : CVE-2026-95371
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Views. CVE-2026-95371 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable,...
PT-2026-97621
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.3 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 Description Improper authorization checks may allow an authenticated user possessing an MCP-scoped token to perform actions that...
CVE-2026-76648: Missing Authorization
CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...
Linux Distros Unpatched Vulnerability : CVE-2026-95285
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to...
CVE-2026-76089: Exposure of Sensitive Information to an Unauthorized Actor
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
CVE-2026-82405: Incorrect Authorization
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An...
Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers
Overview Cinnamon's Kotaemon all versions up to v0.12.0 multi‑user chat interface does not verify conversation ownership when loading a conversation. Any authenticated user can read, delete, rename, or overwrite another user’s conversation data by supplying the correct ID. This results in...
CVE-2026-90951: Incorrect Authorization
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...
CVE-2026-66075: Missing Authorization
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...