WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Modification vulnerability discovered by Averon Averenkov Averon Averenkov in WordPress Plugin Blog2Social versions = 9.1.0...

CVE-2026-67233

A flaw was found in RabbitMQ. An authenticated monitoring user, who is intended to have read-only access, can exploit an improper authorization vulnerability. This allows them to delete or restart 'shovels' in any virtual host they can access, leading to a denial of service or disruption of messa...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604

Prior to v8.0.0 , the ixo Blockchain (Layer 1) x/bonds module contained a flaw where funds could be moved from addresses resolved via DID verification methods without verifying ownership by the transaction signer. An attacker could register a victim's address as a verification method on their own...

SUSE CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

SUSE CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-63203

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

EUVD-2026-86157

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...

CVE-2026-79758

The Termix web-based server management platform (versions 1.8.0 through 2.5.1 ) contains a vulnerability where authenticated users can access the server-stats API without per-host authorization. Specifically, the src/backend/ssh/server-stats.ts routes allow users to view host online/offline statu...

CVE-2026-65422

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

CVE-2026-51995

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

CVE-2026-65422

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

EUVD-2026-85917

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

CVE-2026-65422

A flaw in the authorization mechanism for the Media Gateway API in Genetec Security Center may allow a user lacking playback privileges to generate video thumbnails . The vulnerability impacts confidentiality as indicated by the CVSS score. Remediation is available in Security Center version 5.14...

CVE-2026-65422

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails...

CVE-2026-61821

A flaw was found in pgpartman. A user with partmanuser access can bypass authorization checks in the droppartitionid and droppartitiontime functions. This allows them to move retained child tables to schemas where they typically lack CREATE privileges. The relocation is performed with elevated...

CVE-2026-66075

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service DoS for affected services. This...

CVE-2026-94416

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...