CVE-2026-93678: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization...

CVE-2026-105139: Incorrect Authorization

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...

CVE-2026-104390: Missing Authorization

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27...

CVE-2026-92393: Incorrect Authorization

Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...

CVE-2026-103075: Missing Authorization

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...

CVE-2026-93026: Missing Authorization

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-96335: Missing Authorization

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

CVE-2026-107352: Missing Authorization

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...

Security Updates for Microsoft Exchange Server (October 2026 OOB)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability: - Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. CVE-2026-96940...

Microsoft Exchange Server Elevation of Privilege (October 2026)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. CVE-2026-96940 Not...

CVE-2026-106196

Missing authorization in Navigation in Google Chrome on on iOS prior t...

Linux Distros Unpatched Vulnerability : CVE-2026-106352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive...

CVE-2026-76278: Authorization Bypass Through User-Controlled Key

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the editspl2modulepermissions capability could use the affected Representational State Transfer REST API to access permission grants for SPL2 modules that the user does not have permission to view. The...

SUSE SLES15: docker-stable / docker-stable-bash-completion / etc (SUSE-SU-2026:4535-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4535-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header...

CVE-2026-106324

Incorrect authorization in WebAppInstalls in Google Chrome on on Andro...

CVE-2026-106364

Incorrect authorization in Omnibox in Google Chrome prior to 155.0.805...

CVE-2026-106244

Incorrect authorization in Permissions in Google Chrome prior to 155.0...

CVE-2026-106222

Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.3...

CVE-2026-106246

Incorrect authorization in Browser in Google Chrome prior to 155.0.805...

Linux Distros Unpatched Vulnerability : CVE-2026-106249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafte...