CVE-2026-35445

Winter CMS versions prior to 1.2.13 contained an authorization bypass in the backend's form postback handler dispatch. The _handler POST field was passed directly to the handler dispatcher without validation, unlike AJAX requests which enforced the on[A-Z][\w+]* pattern. This allowed any authenti...

CVE-2026-81035

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls...

EUVD-2026-66611

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls...

CVE-2026-81035 Midday Missing Owner Check on Team Deletion

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls...

CVE-2026-81031

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

EUVD-2026-66607

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81027

one-api (through version 0.6.10 ) contains an authorization bypass in its channel-pinning logic in middleware/auth.go. The software offers two ways to pin a request to a specific upstream channel: a suffix on the API key and a URL path parameter (channelid). Only the suffix path is gated behind a...

Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

Summary A Cloudreve WebDAV account stores a uri that defines the account's root folder. The WebDAV request handler stripPrefix in pkg/webdav/webdav.go trims the /dav prefix from the request path and joins the remainder to that root with fs.URI.JoinRaw, but never checks that the joined URI stays...

GHSA-W5FV-7X5Q-G8QP Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

Summary A Cloudreve WebDAV account stores a uri that defines the account's root folder. The WebDAV request handler stripPrefix in pkg/webdav/webdav.go trims the /dav prefix from the request path and joins the remainder to that root with fs.URI.JoinRaw, but never checks that the joined URI stays...

GHSA-X287-5C68-36WP OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

CVE-2026-79201

A flaw was found in Chromium. Improper access control in the Workers component allows a remote attacker to bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page, potentially leading to unauthorized access to sensitive information or actions...

GHSA-6X9P-4R67-5GJX Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

CVE-2026-7487 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-7487 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-7487

GitLab EE is affected by an improper authorization check where the access control check is implemented after the asset is accessed . An authenticated user with reporter-role permissions who authored a merge request could reset merge request approval rules under certain conditions. The vulnerabili...

CVE-2026-7487 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-18664

A flaw was found in NSD. On systems using little-endian architecture, the software incorrectly compares IP addresses against defined Access Control List ACL ranges. This misinterpretation can lead to a bypass of intended access controls, where IP addresses that should be denied access are instead...

CVE-2026-77553

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device...

CVE-2026-77557

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...