Authorization Bypass

PraisonAI Platform is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization of label and issue-label mutations, where attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label...

CVE-2026-2406

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

EUVD-2026-47621

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

CVE-2026-2406 IDOR in Universe Software's Online Registration and Workflow Management System

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

CVE-2026-2406

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

CVE-2026-2406

An authorization bypass in Universe Software's Online Registration and Workflow Management System (through 12022026) is reported as CVE-2026-2406. The vulnerability stems from a user-controlled key, enabling unauthorized access. CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; base score 6....

CVE-2026-63047 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...

Exploit for Incorrect Authorization in Canonical Ubuntu_Linux

CVE-...

EUVD-2026-47584

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

EUVD-2026-47585

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

EUVD-2026-47590

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

EUVD-2026-47580

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

EUVD-2026-47563

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

EUVD-2026-46636

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...

EUVD-2026-46460

Vulnerability in the Oracle Public Sector Financials International product of Oracle E-Business Suite component: Authorization. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise...

CVE-2026-63262

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the modules/activate dialog handler, which returns the full plaintext commercial license key to any authenticated user with the access.system permission. An attacker can obtain sensitive license information by...

PT-2026-63472

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

PT-2026-63464

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections...

PT-2026-63351

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP...