EUVD-2026-120407

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data...

EUVD-2026-120406

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage...

CVE-2026-123800

SuperTokens Core (an open-source authentication server) contains a vulnerability in Multitenancy.checkPermissionsForCreateOrUpdate within src/main/java/io/supertokens/multitenancy/Multitenancy.java. The root cause is inadequate authorization when updating a parent connection URI domain or the bas...

CVE-2026-123801

The SuperTokens Core authentication server is vulnerable to SAML replay attacks in versions prior to 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1. The SAML.handleCallback function fails to consume RelayState , record assertion identifiers, or enforce Response.InResponseTo . This allows an ...

RED ADM LDAP Authorization Modification

The vulnerability in the “RED ADM” centralized IT infrastructure management system is related to the failure to neutralize special elements within LDAP requests. Exploitation of this vulnerability may allow a remote attacker to gain access and modify authorization data...

CrocoTime authorization Unauthorized Access

The vulnerability of the CrocoTime employee time management system is related to deficiencies in the authorization process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-124590

The zhangbw409 library_manager_system (f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b) is vulnerable to an improper authorization flaw in the BookController.addBook function located at src/main/java/com/zbw/controller/UserController.java. By manipulating the use...

CVE-2026-124621

A vulnerability was determined in kongxin-github JavaLibraryManagementSystem up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function...

CVE-2026-124621

The kongxin-github Java_Library_Management_System contains a vulnerability in the Swing UI Layer component, specifically affecting the file src/view/MainInterface.java. The flaw exists in several functions, including UpdateAdmin.deleteuser, UpdateAdmin.updateadmin, UpdateAdmin.updatepass, Book.ad...

CVE-2026-123475

The MapSVG (mapsvg-lite-interactive-vector-maps) plugin, from version n/a through 8.16.3 , is susceptible to a Missing Authorization vulnerability. This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels . No specific remediation details or exploit links are provided...

CVE-2026-123475

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3...

CVE-2026-121722

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

CVE-2026-121722

The WP E-Signature Formidable Forms Signature Online Contract Automation plugin is affected by a Missing Authorization vulnerability. This flaw allows for the exploitation of Incorrectly Configured Access Control Security Levels in versions n/a through 2.0.5 . No specific root cause details, prac...

CVE-2026-119515

The Radius Booking — Booking Calendar for Appointments & Services WordPress plugin is vulnerable to a Missing Authorization issue in versions up to 1.0.20 . This vulnerability allows for exploiting incorrectly configured access control security levels , potentially leading to unauthorized access....

CVE-2026-119515

Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a...

CVE-2026-113702

A security flaw exists in iomad versions up to 4.5.15, 5.0.11, 5.1.8, and 5.2.4 . The vulnerability affects the local_iomad_pluginfile function within the public/local/iomad/lib.php library of the PDF Certificate Handler component. An attacker can perform a remote attack resulting in an authoriza...

CVE-2026-106008

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS...

EUVD-2026-119995

A vulnerability was determined in kongxin-github JavaLibraryManagementSystem up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function...

EUVD-2026-119992

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

EUVD-2026-119991

Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a...