Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, iOS versions prior to 27.2, and iPadOS versions prior to 26.7.2 and 27.2. This vulnerability stems from insufficient permission checks and may allow applications to fingerprint users...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iPadOS versions prior to 26.7.2, Apple iOS versions prior to 27, and Apple iPadOS versions prior to 27. This vulnerability stems from insufficient permission checks and may allow applications to access sensitive user dat...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2 and Apple iPadOS versions prior to 26.7.2, Apple iOS versions prior to 27.2 and Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Taho...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, macOS Sequoia versions prior to 15.8.2, and macOS Tahoe versions prior to 26.7.2. This vulnerability stems from insufficient permission checks and may allow applications to access sensitive user data...

CVE-2026-78411 Velociraptor Server Metadata update with Insufficient Permission Check

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-78411 Velociraptor Server Metadata update with Insufficient Permission Check

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-78411 Velociraptor Server Metadata update with Insufficient Permission Check

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-78411

The Velociraptor platform contains a vulnerability in the SetClientMetadata function due to an incorrect authorization check (CWE-863). This flaw allows a user possessing only the LABEL_CLIENTS permission to update server metadata , which typically contains site-wide configuration data intended o...

PT-2026-99281

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Insufficient route-level permission checks and a lack of workspace or ownership validation in the backing service allow authenticated low-privilege users or those with a valid API key to access or...

PT-2026-94060

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.11.1 Description Insufficient validation of caller permissions in the 'DELETE /api/v2/rbac/id' endpoint allows users with read access to delete access control relationships. This can enable attackers to revoke the...

SUSE CVE-2026-24690

Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches...

CVE-2026-53635

Open edX Platform is affected by an insufficient permission check in the set_course_mode_price() view at lms/djangoapps/instructor/views/instructor_dashboard.py:430. The endpoint is protected only by @login_required and performs no course-level authorization, meaning any authenticated user —inclu...

CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-53635 Open edX Platform: Insufficient Permission on set_course_mode_price()

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-77144

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-72052

In the Linux kernel, the following vulnerability has been resolved: net: ip6gre: require CAPNETADMIN in the device netns for changelink ip6grechangelink and ip6erspanchangelink operate on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or...

CVE-2026-72061

In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAPNETADMIN in the device netns for changelink ipip6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

CVE-2026-18028

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission,...