CVE-2026-20773: Incorrect Authorization

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

PT-2026-91540

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

PT-2026-91670

Name of the Vulnerable Software and Affected Versions iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 tvOS versions prior to 27 visionOS versions prior to 27 watchOS versions prior to 27 Description An authorization issue exists due to improper state...

CVE-2026-84612: Incorrect Authorization

An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to read persistent device identifiers...

CVE-2026-84535: Improper Access Control

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox...

PT-2026-91649

Name of the Vulnerable Software and Affected Versions iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 tvOS versions prior to 27 visionOS versions prior to 27 watchOS versions prior to 27 Description An authorization issue exists due to improper state...

CVE-2026-43696: Missing Authorization

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization...

PT-2026-91490

Name of the Vulnerable Software and Affected Versions macOS versions prior to Golden Gate 27 Description An authorization issue exists where an application may capture Touch Bar content without proper authorization. This is caused by insufficient entitlement checks, which are permissions granted ...

CVE-2026-84540: Incorrect Authorization

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

CVE-2026-61910

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...

WordPress RSS Aggregator by Feedzy plugin < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability

Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability discovered by Farid Narimanov in WordPress Plugin Feedzy versions 5.2.6...

USN-8674-1 openjdk-lts vulnerabilities

It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attack...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-101282)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101282 advisory. An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4,...

CVE-2026-19006 mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

CVE-2026-18997 cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...

EUVD-2026-52853

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

EUVD-2026-51710

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not...

SUSE CVE-2026-5412

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This...

SUSE CVE-2026-5724

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests...