14778 matches found
EUVD-2026-56109
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...
CVE-2026-72785
Summary (CVE-2026-72785) Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability in the category structure controls. A control-panel user with only the viewCategories permission (no saveCategories ) for a category group can permanently reorder or re-parent categories ...
CVE-2026-72774
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution...
EUVD-2026-56100
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution...
CVE-2026-72774 n8n before 1.123.67 Authentication Bypass via HTTP Request Node
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution...
CVE-2026-72596 Ghost Foundation Ghost - Broken Access Control
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...
EUVD-2026-56035
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...
CVE-2026-72596
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...
CVE-2026-72563
A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsController@update endpoint. The endpoint performs no authorization check, and the Lead model has guarded set to an empty array...
CVE-2026-72545 OpenSignLabs OpenSign - Insecure Direct Object Reference
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target...
CVE-2026-72542
Windmill Labs Windmill (up to version 1.783.0) has a missing-authorization vulnerability. Authenticated operators can write job progress and read job metrics for any job in the workspace because the job_metrics handlers do not perform an authorization check, bypassing workspace-level access contr...
EUVD-2026-56012
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...
CVE-2026-72540
Red Hat CNA-LR concluded that this CVE is not valid...
EUVD-2026-56003
An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...
CVE-2026-72533 Portainer Portainer CE - Authentication Bypass
An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...
CVE-2026-72533
The CVE concerns Portainer CE (up to 2.44.0) with an authentication bypass in the Docker proxy path validation. Authenticated low-privilege users can bypass proxy authorization checks through non-canonical URL normalization, causing the proxy and authorization layer to interpret crafted requests ...
EUVD-2026-56002
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...
CVE-2026-13738 Improper Authorization Validation
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...
CVE-2026-13738
CVE-2026-13738 describes an authorization bypass in CommServe that affects a limited set of command execution operations. The vulnerability impacts a broad set of Commvault components (Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X) and is characterized by a high-sev...