EUVD-2026-84990

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-96271 Photoview through 2.4.0 Authorization Bypass via shareAlbum

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

CVE-2026-96271 Photoview through 2.4.0 Authorization Bypass via shareAlbum

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing...

SUSE CVE-2026-50572

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the...

PT-2026-97490

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

PT-2026-97203

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB versions prior to 2.1.0 Description The plugin fails to properly verify if a user is authorized to perform specific actions. This missing authorization allows authenticated attackers with Contributor-level access or...

CVE-2026-91025: Authorization Bypass Through User-Controlled Key

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

PT-2026-97614

Name of the Vulnerable Software and Affected Versions ByteDance Coze Scraper Extension versions prior to 2.0.3 Description An issue exists in the External Message Handler component within the static/background/index.js file. The chrome.runtime.onMessageExternal.addListener function fails to...

CVE-2026-83555: Missing Authorization

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

PT-2026-97122

Name of the Vulnerable Software and Affected Versions Photoview versions prior to 2.4.1 Description An authorization bypass exists in the shareAlbum GraphQL mutation. This flaw allows authenticated users to generate share tokens for albums they do not own by providing arbitrary album IDs...

CVE-2026-84150: Authorization Bypass Through User-Controlled Key

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-84742: Incorrect Authorization

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

PT-2026-97424

Name of the Vulnerable Software and Affected Versions FileMaker Server versions prior to 26.0.3 Description An authorization bypass exists in the FileMaker Server Web Publishing Engine. By including a forged X-FMI-PE-ExtendedPrivilege header in a request, an attacker can bypass the disabled Custo...

PT-2026-97180

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An authorization check is missing in a REST route, and the route does not restrict the data it stores. This allows unauthenticated users to write unlimited data into the metadata of any user...

CVE-2026-96512: Incorrect Authorization

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

Penpot 2.17.2 Arbitrary File Overwrite

Penpot versions 1.20 through 2.17.2 contain a missing authorization vulnerability in the file import RPC command. An authenticated attacker can supply the identifier of another user's file to overwrite its contents and re-parent the file into an attacker-controlled project, resulting in file...

CVE-2026-66069: Missing Authorization

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

CVE-2026-85724: Incorrect Authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

GitLab 18.7 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92470)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated...

CVE-2026-96680: Missing Authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...