CVE-2026-86323

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mailnotifications endpoint resolves the target account using User.findparams:id without verifying that the...

CVE-2026-86323

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mailnotifications endpoint resolves the target account using User.findparams:id without verifying that the...

CVE-2025-40602

CVE-2025-40602 📌 Overview CVE-2025-40602 is a local privilege escalation vulnerability affecting SonicWall Secure Mobile Access SMA 1000 series appliances. The flaw exists in the Appliance Management Console AMC due to insufficient authorization checks , allowing an authenticated low-privileged...

PT-2026-146049

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail notifications endpoint resolves the target account using User.findparams:id without verifying that the...

CVE-2026-86323: Red Hat: A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific…

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mailnotifications endpoint resolves the target account using User.findparams:id without verifying that the...

CVE-2026-34048

CVE-2026-34048 Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and execute commands on team servers. Intro I found this issue while reviewing Coolify , an open-source self-hosted PaaS, with a very direct...

CVE-2025-40602

CVE-2025-40602 CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console AMC of SonicWall Secure Mobile Access SMA 1000 series appliances. The vulnerability stems from insufficient authorization in the AMC, allowing authenticated remote attackers to escalate...

CVE-2026-109809

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109801

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-109801 Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-109801 Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

EUVD-2026-120684

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-109801

SAP NetWeaver Application Server Java (NWDI Cockpit) is vulnerable to an authorization bypass (CWE-639) because it fails to perform sufficient permission checks when retrieving certain information. A low-privileged attacker can exploit this by sending a specially crafted request to access sensiti...

PT-2026-141256

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109801: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-109809: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

PT-2026-141248

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-123800 SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications

SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in...

CVE-2026-124433

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remo...

CVE-2026-124433

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remo...