PT-2026-64793

Name of the Vulnerable Software and Affected Versions ananocoai NanoClaw versions prior to 2.0.65 Description An improper authorization issue exists within the MCP Server Approval component, specifically affecting the createChatSdkBridge.setup function located in the src/channels/chat-sdk-bridge....

PT-2026-64794

Name of the Vulnerable Software and Affected Versions ananocoai NanoClaw versions prior to 2.0.65 Description A flaw in the add mcp server component allows for improper authorization via remote manipulation. The issue resides within the handleAddMcpServer function located in the...

Exploit for Improper Authorization in Microsoft

No d...

Exploit for Improper Authorization in Microsoft

cve-id Donate Support the maintenance of this project wit...

CVE-2026-62835

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

EUVD-2026-48737

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

CVE-2026-62835

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory...

EUVD-2026-48454

Improper authorization in Azure Red Hat OpenShift ARO allows an authorized attacker to elevate privileges over a network...

PT-2026-64411

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

CVE-2026-56160

Improper authorization in Azure Red Hat OpenShift ARO allows an authorized attacker to elevate privileges over a network...

Azure Portal Information Disclosure Vulnerability

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability

Improper authorization in Azure Red Hat OpenShift ARO allows an authorized attacker to elevate privileges over a network...

PT-2026-64205

Name of the Vulnerable Software and Affected Versions Azure Red Hat OpenShift ARO affected versions not specified Description Improper authorization allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version tha...

GHSA-2XGM-WC4G-5JVG n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

Impact An authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project...

OPENSUSE-SU-2026:21425-1 Security update for PackageKit

This update for PackageKit fixes the following issues: Security issue fixed: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Non security issue fixed: - KDE Discover ignores package locks bsc1263252...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...

GHSA-G9G6-QHRC-P3QC Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

CVE-2026-6792 Improper Authorization in Universal Sotware's FlexCity

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 before 5.542.0...