EUVD-2026-55865

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve,...

CVE-2026-44765

SAP Manufacturing Integration and Intelligence (MII) contains a Missing Authorization Check allowing unauthenticated remote access to scheduling-related functions. Impact is reported as low for confidentiality, integrity, and availability. CVSS 3.1 base score 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/...

EUVD-2026-55864

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...

CVE-2026-44764

CVE-2026-44764 concerns SAP Manufacturing Integration and Intelligence (MII) where a missing authorization check in the Cost Servlet could allow an unauthenticated attacker to send crafted requests with specific parameters, potentially enabling read, create, modify, or delete operations on applic...

PT-2026-70841

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get users, /user/get all users uid, and /group/get groups. Attackers can explo...

PT-2026-70865

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

PT-2026-70025

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A missing authorization check allows an unauthenticated remote attacker to access scheduling-related application functions. This flaw enables the...

PT-2026-70117

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job metrics handlers accept no authorization extractor, bypassing workspace-level...

PT-2026-70067

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Missing authorization checks in the upload azure, upload sftp, and upload smb VQL plugins allow an authenticated user with the analyst role to initiate outbound network connections from...

PT-2026-70116

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update resource type endpoint. The endpoint omits the administrator permission check that the corresponding delete resource type...

PT-2026-70401

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Missing authorization allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a f...

PT-2026-70367

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network...

PT-2026-70033

Name of the Vulnerable Software and Affected Versions SAP ABAP Development Tools affected versions not specified Description SAP ABAP Development Tools fails to perform required authorization checks for specific functionality. This allows an attacker with low privileges to execute unauthorized...

PT-2026-70693

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...

PT-2026-70024

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A missing authorization check allows an unauthenticated attacker to access backend operations by sending crafted requests to the 'Cost Servlet' endpoint...

PT-2026-70772

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...

CVE-2026-72919

Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 exposes a broken access control in the channels.convertToTeam REST endpoint. An authenticated user with the create-team permission could convert an unrelated public channel by providing channelName instead ...

CVE-2026-72906 ERPNext: Unauthorised triggering of automated emails due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated...

Security Bulletin: Vault Enterprise vulnerable to cross-namespace entity deletion

Summary Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability CVE-2026-14886 ...

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...