CVE-2026-116136

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

CVE-2026-116136

ProjectSend versions 2.0.0 through 2.7.1 are vulnerable to an incorrect authorization flaw within the FileVersions::link() function. This vulnerability allows staff users to share files without proper authorization by linking file versions. Specifically, an attacker can link their file onto an in...

EUVD-2026-109388

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

PT-2026-122977

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

CVE-2026-103858

The MISP application (versions earlier than 2.5.48 ) is vulnerable to an incomplete authorization check within its discussion posting functionality. The system fails to properly enforce the full thread access control list, specifically neglecting to verify sharing-group membership and event-level...

CVE-2026-103858 MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization org-only distribution. It did not enforce...

CVE-2026-103858 MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization org-only distribution. It did not enforce...

PT-2026-103840

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization org-only distribution. It did not enforce...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

PT-2026-89171

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An issue exists in the channel branch of the chat completions handler where the system verifies if a user has write access to a channel and if a specific message belongs to that channel, but...

CVE-2026-46605

A flaw was found in Apache ActiveMQ server. An authenticated attacker with proper permissions could exploit an incomplete authorization vulnerability to remove existing destinations. This could lead to a Denial of Service DoS by disrupting message delivery and processing. Mitigation Mitigation fo...

BIT-ACTIVEMQ-2026-46605 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, fr...

Apache ActiveMQ < 5.19.7 / 6.x < 6.2.6 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is prior to 5.19.7 or 6.x prior to 6.2.6. It is, therefore, affected by multiple vulnerabilities: - Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ...

Linux Distros Unpatched Vulnerability : CVE-2026-46605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with prop...

GHSA-CPW7-G3P5-QRFQ Apache ActiveMQ server has an incomplete authorization workflow

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, fr...

CVE-2026-46605

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, fr...

CVE-2026-46605

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, fr...

CVE-2026-46605 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, fr...