SUSE CVE-2026-24690

Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches...

CVE-2026-53635

Open edX Platform is affected by an insufficient permission check in the set_course_mode_price() view at lms/djangoapps/instructor/views/instructor_dashboard.py:430. The endpoint is protected only by @login_required and performs no course-level authorization, meaning any authenticated user —inclu...

CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-77144

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-72052

In the Linux kernel, the following vulnerability has been resolved: net: ip6gre: require CAPNETADMIN in the device netns for changelink ip6grechangelink and ip6erspanchangelink operate on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or...

CVE-2026-72061

In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAPNETADMIN in the device netns for changelink ipip6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission,...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to insufficient permission checks in the process for updating or rebasing pull request branches. An attacker can gain unauthorized access or modify protected branches by exploiting this weakness. Remediation...

CVE-2026-27771

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information...

CVE-2026-27771: Missing Authorization

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information...

Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation the check was only applied on update/patch, which allows an authenticated user holding...

Google Android 安全漏洞

Google Android is an open-source operating system based on Linux, developed by Google Inc. There are security vulnerabilities in Google Android, which stem from insufficient permission checks, potentially leading to local privilege escalation...

CVE-2026-24096

Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 beta before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information...

Apple多款产品 安全漏洞

Apple iOS, among others, are products of the American company Apple. Apple iOS is an operating system developed for mobile devices. Apple macOS is a dedicated operating system designed specifically for Mac computers. Apple iPadOS is an operating system for iPad tablets. Several of Apple’s product...

Misskey 授权问题漏洞

Misskey is an open-source, permanently free social media platform developed by Misskey. Versions of Misskey from 8.45.0 until 2026.3.1 had an authorization issue vulnerability. This vulnerability stemmed from insufficient permission checks and input validation, which could lead to severe data...

CVE-2026-21736

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory . The root cause is the improper handling of memory protections for the user-mode wrapped memory resource, specifically due to an insufficient p...

CVE-2026-25859

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...

EUVD-2026-5703

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...