CVE-2026-97281: Missing Authorization

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-103341: Missing Authorization

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...

PT-2026-104006

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description The WebSocket Application Programming Interface lacks rate limiting on authentication requests. This deficiency allows an attacker to perform brute-force attacks to obtain unauthorized acce...

CVE-2026-71453: External Control of File Name or Path

External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-97297: Missing Authorization

Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...

CVE-2026-97277: Missing Authorization

Subscriber Broken Access Control in Social Boost = 3.6.2 versions...

CVE-2026-102381: Missing Authorization

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...

CVE-2026-62061: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-97258: Missing Authorization

Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-104015

Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description UDP traffic between the operator control unit and the robot is transmitted in cleartext without a cryptographic integrit...

CVE-2026-51892

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...

CVE-2026-51897

RAGFlow version 0.24.0 is affected by an improper access control vulnerability in the get_dataset() function located within the api/apps/evaluation_app endpoint. This flaw allows an attacker to trigger attacker-controlled code or command execution , depending on the exposed entry. As a temporary ...

PT-2026-105482

Summary /api/storage/getOutlineStorage is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, setOutlineStorage...

PT-2026-103844

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51893

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

Dell Rugged Control Center < 5.2.206 Multiple Vulnerabilities (DSA-2026-410)

The version of Dell Rugged Control Center RCC installed on the remote host is prior to 5.2.206. It is, therefore, affected by multiple vulnerabilities: - An improper authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to...