CVE-2026-15373 Eleveo Call Recording Software userAddAction.do improper authorization

A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It is possible to initiate the attack remotely. The exploit is...

EUVD-2026-42917

A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It is possible to initiate the attack remotely. The exploit is...

CVE-2026-15373 Eleveo Call Recording Software userAddAction.do improper authorization

A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It is possible to initiate the attack remotely. The exploit is...

CVE-2026-15373

CVE-2026-15373 affects Eleveo Call Recording Software 9.7.0. The vulnerability lies in an unknown function of the file /callrec/userAddAction.do, where manipulating the argument role enables improper authorization. It can be started remotely, and the exploit is public. Vendor response was not pro...

Improper Authorization

Leantime is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks in the Users::getUser JSON-RPC API, where authenticated users can retrieve sensitive credential data for arbitrary user accounts, allowing attackers to obtain password hashes, TOTP secrets,...

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

CVE-2026-21056

Samsung Health before version 7.00.0.107 has an improper authorization flaw that enables local attackers to access information on connected devices. The issue is limited to local access with low privileges per the CVSS metrics, and the impact is confined to confidentiality of connected-device inf...

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

EUVD-2026-42826

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...

CVE-2026-21044

Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...

CVE-2026-21044

Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...

CVE-2026-21044

CVE-2026-21044 describes Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1, allowing local attackers to bypass the application’s persistence configuration. The vulnerability enables a local attacker with low privileges and no user interaction to access or modify persisten...

EUVD-2026-42815

Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...

PT-2026-57203

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-61474

An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharinggroupid without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly s...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the GetNotesByBookID function. An attacker can access metadata of soft-deleted notes belonging to any public book by sending unauthenticated requests with the deleted query parameter set to true. This allows...

Improper Authorization

github.com/coder/coder is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation in the UpsertWorkspaceApp and insertAgentApp functions, which fail to verify that a supplied application ID belongs to the workspace being built before performing a cross-workspace...

K000162157: Apache Tomcat vulnerability CVE-2026-43513 and CVE-2026-43515

Security Advisory Description CVE-2026-43513 Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0....

CVE-2026-11827

A flaw was found in GitLab EE. An authenticated user with maintainer-role permissions could, under specific conditions, exploit improper authorization controls. This vulnerability allows the user to obtain other users' stored credentials, leading to unauthorized information disclosure...