EUVD-2026-92930

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-105572

A vulnerability exists in PickMall Lilishop version 4.2.4 and below, specifically within the Buyer Invoice List component. An unknown function in the /buyer/trade/receipt file is susceptible to authorization bypass when the memberId argument is manipulated. This flaw is exploitable remotely . Pub...

CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

nextjs-middleware-exploit

Pesquisa sobre Vulnerabilidade no Middleware do Next.js CVE-2025-29927 Este repositório demonstra uma vulnerabilidade crítica no middleware do Next.js CVE-2025-29927, que afeta as versões 11.1.4 até 15.1.7. Esta vulnerabilidade permite desvio de autorização , desvio de CSP e potenciais ataques Do...

CLEANSTART-2026-YR68258 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...

PT-2026-107237

Name of the Vulnerable Software and Affected Versions QnABot on AWS versions 7.0.0 through 7.4.5 Description An authorization bypass exists in the optional Amazon Q Business Lambda hook sample. This issue occurs due to a user-controlled key, which may allow an authenticated remote user to read...

CVE-2026-106324: Incorrect Authorization

Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107290

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/push mirrors checked only whether mirroring was enabled and not the mirror DISABLE NEW PUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 Incorrect Authorization (ESA-2026-199)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-199 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information...

AlmaLinux 9 : sudo (ALSA-2026:75571)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75571 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

CVE-2026-103009: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-106389: Incorrect Authorization

Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Medium...

PT-2026-106340

Name of the Vulnerable Software and Affected Versions File Media Renamer versions prior to 1.4 Description The File Media Renamer WordPress plugin fails to verify if the requesting user is authorized to modify a specific media attachment. This allows any user with file-upload privileges to rename...

PT-2026-106718

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id rooms parameter to change status, floor,...

RockyLinux 10 : sudo (RLSA-2026:75579)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75579 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

PT-2026-106336

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

PT-2026-106312

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-106280: Incorrect Authorization

Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...