PT-2026-62092

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Insufficient authorization controls in the ingest simulation feature allow an authenticated user with limited index privileges to target indices they are not authorized to access...

CVE-2026-55544

NextCRM (open-source) vulnerability CVE-2026-55544 affects version 0.12.1, where MCP campaign tools expose read/write operations over the network via user-generated Bearer tokens (nxtc__...). Despite an authorization model restricting normal users to their own campaigns, multiple MCP handlers ign...

CVE-2026-47130 NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-16337

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote co...

CVE-2026-10755 All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

dotnet: .NET: Security feature bypass due to incorrect authorization

A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system...

CVE-2026-16199 nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialedexec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published...

CVE-2026-16126

The CVE affects zevorn rt-claw up to version 0.2.0, specifically the Swarm RPC Receiver’s Swarm.c handle_rpc_request function. The root cause is a manipulation that leads to incorrect authorization, enabling remote exploitation. Public exploit information exists and is accessible. No remediation ...

CVE-2026-16122

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/execapproval.go. The manipulation results in incorrect authorization. The exploit has been released to...

CVE-2026-16123

The vulnerability CVE-2026-16123 affects nextlevelbuilder GoClaw up to version 3.13.2. It resides in ToolsInvokeHandler.ServeHTTP (internal/http/tools_invoke.go, Invoke Endpoint) and is caused by a manipulation that leads to missing authorization. This allows remote exploitation, with a public ex...

CVE-2026-16122

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/execapproval.go. The manipulation results in incorrect authorization. The exploit has been released to...

CVE-2026-16122 nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/execapproval.go. The manipulation results in incorrect authorization. The exploit has been released to...

CVE-2026-16122

Nextlevelbuilder GoClaw up to 3.13.2 is affected by CVE-2026-16122. The vulnerability is in extractBin/RequestApproval/matchesAllowlist of internal/tools/exec_approval.go and allows manipulation that results in incorrect authorization. The exploit has been released publicly and may be used for at...

CVE-2026-16122 nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/execapproval.go. The manipulation results in incorrect authorization. The exploit has been released to...

EUVD-2026-45383

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/execapproval.go. The manipulation results in incorrect authorization. The exploit has been released to...

CVE-2026-16119 nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization

A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/execapproval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in incorrect authorization. The attack is possible to be carried...

PT-2026-60973

A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle rpc request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. T...

PT-2026-60969

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/exec approval.go. The manipulation results in incorrect authorization. The exploit has been released t...

PT-2026-60994

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is possible to launch the attack remotely. T...

CVE-2026-54244 Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A...