Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

Concrete CMS - User Enumeration

Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel concrete/controllers/panel/page/previewasuser.php. id: CVE-2026-18110 info: name: Concrete CMS - User Enumeration author: community severit...

CVE-2026-84183

A flaw was found in Apache OFBiz. An improper authorization check allows a remote authenticated user with limited view permissions to modify restricted content and execute arbitrary commands. By exploiting flawed permission validation to evaluate server logs containing injected input as applicati...

CVE-2026-62279

A flaw was found in LubeLogger. An authenticated user could exploit a missing authorization check in the DuplicateRecordsToOtherVehicles endpoint. This vulnerability allows the user to copy vehicle maintenance and fuel mileage records belonging to other users into their own vehicle. This leads to...

CVE-2026-110621

A flaw was found in Swetrix Cloud. A missing authorization check allows an authenticated remote attacker to take control of arbitrary projects by linking them to their own organization. By supplying a victim project's public tracking identifier, an attacker can access sensitive analytics data,...

dllspy

DllSpy Scans compiled .NET assemblies to discover input surfaces HTTP endpoints, SignalR hubs, WCF services, gRPC services, Razor Pages, Blazor components, Azure Functions, OData endpoints, check authorization configuration, and flag security issues — all without running the application. Availabl...

CVE-2026-76152

Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via...

CVE-2026-73580

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and...

CVE-2026-76150

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content vi...

EUVD-2026-117488

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content vi...

CVE-2026-118624

A flaw was found in MLflow. An authenticated remote attacker can exploit a missing authorization check within the Tracking Server Jobs functionality, specifically in the findvalidator function. Successful exploitation allows the attacker to access and disclose sensitive information in the context...

CVE-2026-115364

A flaw was found in OpenBao. This vulnerability allows a remote attacker to cause a Denial of Service DoS by shutting down Agent and Proxy services. Due to a missing authorization check, administrative termination endpoints fail to validate the presence of the required security header even when...

VulnCheck KEV: CVE-2026-81648

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration an...

PT-2026-134432

Name of the Vulnerable Software and Affected Versions Mapster WP Maps WordPress plugin versions prior to 2.0.6 Description An authorization bypass exists in a REST API route used for writing post data. This allows unauthenticated attackers to overwrite the titles of arbitrary posts, create new...

CVE-2026-13068

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

CVE-2024-6375

A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, pri...

BIT-OPENBAO-2026-115364 OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down the...

PT-2026-132456

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require request header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down...

EUVD-2026-111720

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal M...

CVE-2026-115624

The GROWI platform is susceptible to a missing authorization check vulnerability within its collaborative editing feature . This flaw allows users with limited access—such as guest users , users with read-only permissions , or users in pending, suspended, or invited statuses —to bypass intended r...