CVE-2026-86336

Apache TomEE running on JDK 21 or later is vulnerable to a missing authorization flaw where EJB method authorization checks are silently skipped. This allows callers to invoke EJB methods without the enforcement of configured access restrictions (CWE-862 ). To remediate this issue, users are reco...

CVE-2026-86336 Apache TomEE: EJB method authorization is silently skipped on JDK 21+

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue...

SUSE CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-34507: Incorrect Authorization

OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks. Attackers can route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have...