CVE-2022-36539

CVE-2022-36539 Insecure Direct Object Reference IDOR WeDayCare B.V. WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children. Traffic with the API is made transparent via a proxy such as Burp Suite...

CVE-2026-88198

A missing authorization vulnerability in Microsoft Office SharePoint (CVE-2026-88198) allows an authorized attacker to elevate privileges over a network. The impact is rated as High with a CVSS 3.1 score of 8.8. Microsoft has released official updates to address this issue; users are recommended ...

CVE-2026-87714

A missing authorization vulnerability in WebDAV allows an authorized attacker to bypass a security feature over a network. The vulnerability is associated with CWE-862 and has been assigned a CVSS 3.1 base score of 6.5 (MEDIUM) . The impact is primarily on integrity . No specific affected version...

CVE-2026-70085

A missing authorization vulnerability exists in the DNS Server , which allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-862 . The CVSS 3.1 score is 5.5 (Medium) , with a high impact on integrity . No specific exploit information or patch versio...

CVE-2026-70098

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-102233

A missing authorization vulnerability in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally . The vulnerability has a CVSS 3.1 score of 7.8 (High), with the attack vector identified as local and requiring user interaction. No specific component details, root c...

CVE-2025-2539

POC - CVE-2025-2539 File Away Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

CVE-2026-106176

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests . The vulnerability is associated with CWE-862 and has a LOW base severity score of 3.8. No specific exploit details or remediat...

CVE-2026-44848-PoC

CVE-2026-44848 — Portainer: Missing Authorization on Docker Plugin Endpoints → Host RCE Proof-of-concept for CVE-2026-44848 , a missing-authentication CWE-862 vulnerability in Portainer that lets a non-admin user with Docker endpoint access perform privileged Docker plugin operations → full host...

CVE-2023-32117

CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"img alt='' src="http:///%5C/%5C/2.gravatar.com%5C/avatar%5C/b58996c504c5638798eb6b511e6f49af?s=32&d=mm&r=g"...

CVE-2026-110131

ThriveX-Server versions through 4.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the GET /api/article and /api/article/{id} endpoints. This flaw allows unauthenticated attackers to access non-public content, including unpublished drafts and soft-deleted articles . Expl...

CVE-2026-110123

Makunet maku-boot versions 4.3.0 through 5.0.0 are affected by a missing authorization vulnerability. Authenticated users can bypass authority checks by calling the /sys/mail/config/list and /sys/sms/config/list endpoints. This flaw allows attackers to retrieve sensitive information, including un...

CVE-2026-110118

WorkFlow-Engine versions through 9.6.11 are susceptible to a missing authorization vulnerability (CWE-639) within the /vue/buttonOperation endpoints. This flaw allows low-privileged authenticated users to complete or reassign workflow tasks belonging to other users by supplying a known taskId to ...

CVE-2026-110117

SmartAdmin versions through 3.30.0 are affected by a missing authorization vulnerability within the AdminProtectController . This flaw allows authenticated low-privileged employees to access and modify system-wide level-3 protection settings. Specifically, attackers can invoke the unannotated upd...

CVE-2026-110110

JetLinks Community through version 2.10.0 is vulnerable to a missing authorization flaw (CWE-862) in the AlarmConfigController . Specifically, the _enable and _disable endpoints lack the required save action annotation . This allows users with only query access to toggle alarms by ID, potentially...

CVE-2026-110109

Versions of JetLinks Community through 2.10.0 are susceptible to a missing authorization vulnerability (CWE-862) in the transparent-codec component. An attacker with only query access can exploit the POST /device/transparent-codec/{productId} endpoint, which lacks the required @SaveAction permiss...

CVE-2026-110108

MateCloud versions through 5.0.8 are affected by a missing authorization vulnerability within the StorageController . This flaw allows any authenticated user, including low-privilege or self-registered accounts, to interact with unprotected /api/1/admin/storage endpoints. By supplying arbitrary b...

CVE-2026-110105

The B3log Symphony application, versions through 3.6.4 , is affected by a missing authorization vulnerability. The root cause is located in PermissionMidware.check , which incorrectly permits access to routes that lack corresponding permission.rule.url entries. This flaw allows unauthenticated at...

CVE-2026-110100

Jorani versions prior to 1.0.4 are vulnerable to a missing authorization flaw in the Contracts::import() function. This allows any authenticated user to import "days off" into any contract using an arbitrary URL via a POST request. Consequences include the ability to overwrite non-working-day cal...

CVE-2026-110099

The Jorani application (versions before 1.0.4 ) is susceptible to a missing authorization vulnerability within the Hr controller . Specifically, the exportLeaves, exportOvertime, and exportEmployees actions do not properly restrict access, allowing any authenticated user to export sensitive HR da...