EUVD-2026-51186

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

EUVD-2026-51158

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

PT-2026-66509

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0 Description An improper authorization issue allows an authenticated user with chart update permissions to modify dashboards they do not own. This occurs when updating chart properties via the REST API,...

EUVD-2026-50479

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request d...

Security update for PackageKit

This update for PackageKit fixes the following issue: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3405-1 Security update for PackageKit

This update for PackageKit fixes the following issue: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250...

SUSE-SU-2026:3404-1 Security update for PackageKit

This update for PackageKit fixes the following issues: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

EUVD-2026-49878

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

UBUNTU-CVE-2026-61487

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...

Improper Authorization

OpenClaw is vulnerable to Improper Authorization. The vulnerability is due to insufficient enforcement of network access policies in the sandbox exec-server, allowing lower-trust callers to bypass configured restrictions and send HTTP requests to internal network resources that should be...

CVE-2026-14167 ads-tec Industrial IT: Privilege escalation during configuration import

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

SUSE SLES16: PackageKit / PackageKit-backend-zypp / PackageKit-branding-upstream / etc (SUSE-SU-2026:22860-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22860-1 advisory. Security issue fixed: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Non...

PT-2026-65414

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

CVE-2026-17530

AstrBotDevs AstrBot (up to v4.25.5) contains a vulnerability in the Subagent component where the function _build_handoff_toolset (file AstrBot/astrbot/core/astr_agent_tool_exec.py) allows manipulation that leads to incorrect authorization . The flaw can be remotely exploited and has been publicly...

EUVD-2026-49322

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astrmainagent.py. The manipulation of the argument req.functool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available an...

Exploit for Improper Authorization in Microsoft

Certighost Slidev deck This directory contains the Slidev pre...

CVE-2026-17434 nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2026-17434 nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...