EUVD-2026-93662

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...

CVE-2026-106511: Missing Authentication for Critical Function

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...

PT-2026-107117

Name of the Vulnerable Software and Affected Versions multisig-improved repository: mx-multisig-and-modules affected versions not specified Description The reference implementation of the on-chain multisig smart contract system contains a flaw where a missing independent authorization check allow...

PT-2026-107166

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An incorrect authorization weakness exists in a configurable, non-default privilege that allows administrators to delegate limited role-management capabilities to other users scoped to...

Missing Role-Based Access Control (RBAC) and Logical Switch Isolation on Brocade Fabric OS MAPS Violation Data API Endpoint

: A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data acros...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-63435

A flaw was found in Mail, an internet library for Ruby. The library's decoding of RFC 2047 encoded-words in email headers was vulnerable to an overly greedy charset capture. A remote attacker could exploit this by crafting a malformed encoded-word in an address display name or local part. This...

PT-2026-104605

Name of the Vulnerable Software and Affected Versions Razorpay for WooCommerce WordPress plugin versions prior to 4.8.8 Description An issue exists where the plugin fails to perform ownership or authorization checks on a REST API route used during the checkout process. This allows unauthenticated...

GO-2026-6567 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet...

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit 9b8e8956f on 2026-07-27 and is present on the current development head. No released stable version is affected. Summary /api/av/getAttributeViewSearchTarget is registered with...

GHSA-9CQF-HHRQ-7V45 SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit 9b8e8956f on 2026-07-27 and is present on the current development head. No released stable version is affected. Summary /api/av/getAttributeViewSearchTarget is registered with...

CVE-2026-103858

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization org-only distribution. It did not enforce...

EUVD-2026-90770

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization org-only distribution. It did not enforce...

SUSE CVE-2026-13720

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

PT-2026-105586

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet...

Rocky Linux 10.1 [CIQ] Security Update: libudisks2 / libudisks2-debuginfo / libudisks2-devel / udisks2 / etc Multiple Vulnerabilities (crlsa-2026_3476)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263476 advisory. udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API CVE-2026-26104 udisks: Missing Authorization...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

EUVD-2026-90275

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of...

CVE-2026-13720

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...