CVE-2026-34213

CVE-2026-34213 A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace. Intro I identified, responsibly disclosed, and reproduced a High-severity authorization flaw in Docmost , the...

EUVD-2026-97589

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-85950

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected by an authorization flaw within the REST extensions . This improper privilege management allows a remote attacker with administrative privileges to access authentication material belonging to higher-privileg...

EUVD-2026-97509

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized...

CVE-2026-85947

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to an authorization flaw within specific forest-management operations . A remote attacker possessing forest-management privileges can exploit this flaw to create a persistent unauthorized administrator acc...

EUVD-2026-97505

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account,...

CVE-2026-104682

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery...

Apache-Pluto-3.0.0--CVE-2018-1306

CVE-2018-1306 Problema en la lógica de autorización de Apache Pluto 3.0.0 que permite a un atacante cargar archivos maliciosos manipulando métodos HTTP. Script escrito en python3. Uso: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp...

cve-2026-75157-poc

CVE-2026-75157 PoC Authorized security research PoC for the Apache Airflow queued-events authorization flaw in versions before 3.3.2. Scope Run only against an Airflow instance you own or are explicitly authorized to test. The default runner refuses non-loopback targets. This repository contains ...

EUVD-2026-96345

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth...

CVE-2026-106212

An incorrect authorization flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/540072162...

CVE-2026-106410

A missing authorization flaw was found in the Permissions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517801814...

CVE-2026-106295

An incorrect authorization flaw was found in the Unbounded Element component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553138969...

CVE-2026-106280

An incorrect authorization flaw was found in the PermissionElement component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517366426...

CVE-2026-106397

An incorrect authorization flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/503725788...

CVE-2026-106389

An incorrect authorization flaw was found in the USB component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/503625361...

CVE-2026-106314

An incorrect authorization flaw was found in the Bluetooth component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501533684...

CVE-2026-106313

An incorrect authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/498770931...

CVE-2026-106246

An incorrect authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514070956...

CVE-2026-106241

An incorrect authorization flaw was found in the Search component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501729675...