Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

CVE-2026-105998

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

PT-2026-120450

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

CVE-2026-79620

Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are recommended to...

CVE-2026-106028

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

EUVD-2026-104082

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

PT-2026-117229

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

dllspy

DllSpy Scans compiled .NET assemblies to discover input surfaces HTTP endpoints, SignalR hubs, WCF services, gRPC services, Razor Pages, Blazor components, Azure Functions, OData endpoints, check authorization configuration, and flag security issues — all without running the application. Availabl...

CVE-2026-109588 Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel

Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 Armv8-R AArch64 MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond th...

CVE-2026-109588

The FreeRTOS-Kernel (versions V11.3.0 and V11.3.1 ) is vulnerable to a numeric truncation error in the MPU buffer authorization check on the Arm Cortex-R82 (Armv8-R AArch64) MPU port. This flaw may allow an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond t...

CVE-2026-105974

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

EUVD-2026-102689

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user Subscriber and above to read other users' submitted contact information, including names, email...

PT-2026-115865

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations...

CVE-2026-110772

A flaw was found in sure. A missing authorization check in the bulk update functionality allows authenticated users with restricted or read-only permissions to bypass account sharing restrictions. By submitting arbitrary transaction identifiers during a bulk update request, an attacker can modify...

CVE-2026-89202

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including...

CVE-2026-14552

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external...

CVE-2026-89124

The Display Product Catalog Based on Customs Declaration application within SAP Global Trade Services, edition for SAP HANA contains a missing authorization check (CWE-863). This flaw allows an authenticated low-privileged user to access sensitive information outside their intended authorization ...

CVE-2026-89124 Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)

Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impac...

CVE-2026-89108

SAP Manufacturing Integration and Intelligence (Configuration Service) contains a missing authorization check (CWE-862) within certain administrative functionalities. An attacker possessing MII administrator privileges can submit a specially crafted request to provision an account with elevated p...

PT-2026-111173

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description Incorrect authorization checks allow an authenticated user with a project-scoped fine-grained Personal...