EUVD-2026-66118

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation...

GHSA-GCX9-497G-6CP6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

PT-2026-82100

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An improper authorization check allows an authenticated user with reporter-role permissions who authored a merge...

PT-2026-82223

Name of the Vulnerable Software and Affected Versions Midday affected versions not specified Description An authorization flaw exists in the team management logic where the system fails to verify the user role during team deletion and updates. The delete procedure in the...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

PT-2026-82047

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Broken access control allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations hosted on the same instance. Additionally, an...

PT-2026-82368

Name of the Vulnerable Software and Affected Versions Drupal Blazy versions 0.0.0 through 3.0.18 Description An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not...

EUVD-2023-60608

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

CVE-2026-75338

disconf (Distributed Configuration Management Platform) version 2.6.36 suffers from an Incorrect Access Control flaw. The LoginInterceptor explicitly whitelists four config-fetching endpoints—/api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list—bypassing authenticatio...

Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous...

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

PT-2026-82334

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.1 Description Cluster-scoped APIs do not consistently validate per-cluster access. This allows an authenticated user with cluster management permissions to operate on clusters outside their granted scope. Because t...

CVE-2026-26447

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap...

PT-2026-82049

Name of the Vulnerable Software and Affected Versions Reviews and Rating – Google Reviews plugin for WordPress versions prior to 5.11 Description Stored Cross-Site Scripting occurs because the wp display shortcode handler allows attacker-controlled html tags values to define raw HTML tags and emb...

PT-2026-82333

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.0 Description SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, allowing SSO, OIDC, and SAML management operations to be accessed without...

PT-2026-82316

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...