Gitea ChangeTargetBranch Privilege Bypass

The vulnerability of the ChangeTargetBranch function in the services/pull/pull.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges or circumvent security restrictio...

Gitea init-function internalAPITransport Internal

The vulnerability of the init-function in the internalAPITransport function in the modules/private/internal.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentialit...

Gitea API Disclosure Sensitive Information

The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea DeleteCollaboration Disclosure

The vulnerability of the DeleteCollaboration function in the services/repository/collaboration.go file of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea ToHook Function Information Disclosure

The vulnerability of the ToHook function in the services/webhook/general.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected by this functio...

CVE-2026-51915: Improper Access Control

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51901: Improper Access Control

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-13413: Improper Access Control

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, ...

CVE-2026-51904: Improper Access Control

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-102795: Improper Access Control

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

PT-2026-104408

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description An improper access control issue exists where SNI-to-Host access control is not enforced. Approximately 311,500 instances are...

CVE-2026-104914: Missing Authorization

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes e.g., via the deleted-attributes search or the paginated attribute listing, the application returned soft-deleted attributes...

ROS-20261002-73-0086

The vulnerability of the ALTER TABLE/ALTER TYPE command in the PostgreSQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to delete or modify data...

SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error...

tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

Malware in homestack-cheer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-71453

External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...