GHSA-7C34-32V3-J575 Payload relationship-query authorization bypass

Impact A readable collection could expose information about protected documents in a related collection. You are affected if: - You expose a readable collection with a relationship to a collection protected by access.read where constraints. Patches Users should upgrade Payload packages to = 3.90....

NPM: Payload relationship-query authorization bypass

NPM: Payload relationship-query authorization bypass vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

CVE-2026-104070

The Crayons plugin for SPIP versions before 3.5.0 is vulnerable to a missing authorization flaw in crayons_store.php. By omitting the secu_ anti-forgery parameter, unauthenticated attackers can bypass modification checks and modify arbitrary editable object fields. This allows attackers to chain ...

CVE-2026-104070 SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105852

The Payload headless content management system is vulnerable to an authorization bypass in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . The root cause is that querying a readable collection with a relationship to another collection can expose information about documents in ...

CVE-2026-105852 Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

OPENSUSE-SU-2026:22035-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276744. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue...

CVE-2026-25197

CVE-2026-25197: تجاوز التفويض عبر مفتاح يتحكم به المستخدم IDOR استشارة الحقل| القيمة ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 التحديث أ CVSS 3.1| 9.1 حرج المتجه| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 تجاوز التفويض عبر مفتاح يتحكم به المستخدم الباحث| Michael Groberman —...

linux-kernel-codex-harness-v2

Kernel Codex Harness v2 한국어 | English Outil de recherche · Import d'origine : 3 avril 2026 · Révision de la documentation v2 : 11 juillet 2026 Signal externe : de l'allocation de l'attention au triage sensible à la provenance Utilisez des observations reproductibles pour guider l'attention du...

CVE-2026-57850

Summary RustDesk sessions are authorized for a specific connection type — Remote full desktop control, FileTransfer, PortForward, ViewCamera, or Terminal. Before 1.4.9, the server's post-authorization message gate only checked one boolean, self.authorized, and never re-checked it against the...

CVE-2026-105836

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105836

The QloApps application, through version 1.7.0 , is affected by an authorization bypass vulnerability within the AdminProductsController::ajaxProcessBulkUpdateRooms function. This flaw allows hotel-restricted back-office employees to modify room details for hotels outside of their own jurisdictio...

CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

EUVD-2026-93380

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

RLSA-2026:75579 Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: sudo: TZ environment variable allows...

CVE-2021-34824

إعادة إنتاج CVE-2021-34824 إعادة إنتاج ثغرة قديمة في Istio ستساعد هذه المجموعة من السكربتات والمانيفستات في استكشاف ثغرة أمنية قديمة في Istio والتي سمحت لمستخدمي Istio الخبيثين بالوصول إلى أسرار Kubernetes التي لا ينبغي لهم الوصول إليها. هذه الإعادة مستندة إلى منشور المدونة هذا الذي يحتوي على بعض...

cve-2026-47777

CVE-2026-47777 — تجاوز التحقق من الإذن للمجموعات المميزة في Mastodon نظرة عامة لقد قمت بإبلاغ مسؤول عن ثغرة تجاوز التحقق من الإذن عالية الخطورة تؤثر على خط أنابيب الفيدرالية للمجموعات المميزة التجريبية في Mastodon. معرف CVE: CVE-2026-47777 المكون المتأثر ActivityPub::VerifyFeaturedItemService نقا...