CVE-2026-119646

The Open Web Analytics software before version 1.14.1 contains an authorization vulnerability in its REST Report API . The root cause is that clickstream and transaction reports are not properly scoped to the authorized siteId . Consequently, an authenticated user with view_reports permissions on...

CVE-2026-119646 Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

CVE-2026-119646 Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

CVE-2026-119646: Open Web Analytics: Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other…

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

CVE-2026-102816

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause...

CVE-2026-102816 Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause...

EUVD-2026-111275

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause...

CVE-2026-102816

The TP-Link RE305 V3 is affected by an authorization vulnerability in its country or region configuration interface . An unauthenticated attacker on the same local network can modify the wireless regulatory region, forcing the device to reapply its wireless configuration. Successful exploitation ...

PT-2026-127150

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration. Successful exploitation may cause...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

EUVD-2026-106885

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082

Versions of Trigger.dev before 4.6.2 are susceptible to an authorization vulnerability involving overly broad realtime session stream credentials . Public-token holders with session write access can obtain environment-wide S2 stream credentials through session input initialization. This allows an...

CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

PT-2026-120208

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

WordPress MiniOrange OTP Login, Verification, and SMS Notifications: Authorization Vulnerability

WordPress miniOrange OTP Login, Verification, and SMS Notifications: Versions prior to 5.5.8 have an authorization issue vulnerability. This vulnerability stems from the modelayotpprocess function, which short-circuits the authentication process before password verification or administrator inten...

Oqtane Framework Authorization Vulnerability

The Oqtane Framework versions 10.2.6 and earlier have an authorization vulnerability. This vulnerability stems from a permission bypass issue in the SettingController. Attackers can use their alias to request entityId from other sites, thereby reading the stored SMTPPassword and SMTPClientSecret...

Mark Otway Damselfly – A Photo Management System Authorization Vulnerability

Mark Otway Damselfly – A Photo Management System 4.5.3 and earlier versions have an authorization vulnerability. This vulnerability arises from the fact that the controller’s authorization properties are commented out, allowing unauthorized attackers to access all/api/ routes. They can create...

Ivanti Connect Secure Authorization Vulnerability

Ivanti Connect Secure versions prior to 22.8R2 to 22.8R2.5, 25.1.0.0 to 25.1.1.2, and 25.1.2.0 to 25.1.3.0 contain an authorization vulnerability. This vulnerability stems from bypassing authentication through deception, potentially allowing remote, unauthenticated attackers to execute arbitrary...