CVE-2025-14562: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a...

PT-2026-65871

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.6 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An improper authorization check on merge request collaboration settings allows an authenticated user with...

PT-2026-65873

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.0 through 19.0.4 GitLab EE versions 19.1 through 19.1.2 GitLab EE versions 19.2 through 19.2.0 Description A race condition in approval rule processing may allow an authenticated user to merge code into a protected branch...

CVE-2026-13113: Time-of-check Time-of-use (TOCTOU) Race Condition

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race conditio...

CVE-2026-15077: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed b...

CVE-2026-15831: Generation of Incorrect Security Tokens

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during tok...

CVE-2026-50622: Missing Authorization

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2026-66724: Missing Authorization

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover...

CVE-2026-15992 WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation

The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the getuser function of the ModulePasswordHint class, which unconditionally calls WPUser::setrole with...

CVE-2026-15992

The WP Password Policy plugin for WordPress (

EUVD-2026-49953

IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user...

CVE-2026-7362

IBM Sterling B2B Integrator and IBM Sterling File Gateway are affected by CVE-2026-7362. A authenticated user could obtain sensitive information that should be accessible only to privileged users. Affected versions: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0–6.2.1.1_2 and 6...

CVE-2026-7362

IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user...

EUVD-2026-49878

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751

CVE-2026-66751 affects Let’s Chat 0.3.0–0.4.8. The issue is an improper authorization in the server’s room deletion flow: any authenticated user can archive any room by sending a DELETE to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing end...

WordPress WowStore – Store Builder & Product Blocks for WooCommerce plugin <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WowStore versions = 4.4.24...

CVE-2026-58341

A flaw was found in Moodle. The actions to enable and disable group messaging did not include the necessary token to prevent a Cross-Site Request Forgery CSRF risk. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, potentially leading to...