EUVD-2026-94251

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...

CVE-2025-29927-NextJs-Middleware-Simulation

CVE-2025-29927: Next.js Middleware Authorization Bypass Simulation This repository demonstrates the exploitation of CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass middleware-based authorization checks. The flaw stems from improper handling of the internal...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...

CVE-2025-25257

Fortinet FortiWeb CVE-2025-25257 Vulnerability Tester Description This PowerShell script is designed for authorized penetration testing purposes only. It tests Fortinet FortiWeb appliances for CVE-2025-25257, an unauthenticated SQL injection vulnerability in the /api/fabric/device/status endpoint...

CVE-2026-104651

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

kit-policy

kit-policy A flexible, composable authorization framework for Kit, inspired by Ruby's Action Policy. TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit...

CVE-2026-34990

CVE-2026-34990 Description CVE-2026-34990 - OpenPrinting CUPS versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on...

CVE-2026-104678

The CP Media Player WordPress plugin (versions before 1.3.4 ) is vulnerable to an improper access control flaw in its settings-page handler . Due to a lack of capability checks, users with only Contributor-level access can perform actions reserved for administrators, such as creating, modifying, ...

CVE-2026-106355

A missing authorization flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/559777100...

CVE-2026-106350

An incorrect authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553270559...

CVE-2026-106195

An incorrect authorization flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553930843...

CVE-2026-106371

An incorrect authorization flaw was found in the Transactions Platform component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553326010...

CVE-2026-106270

An incorrect authorization flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553269860...

CVE-2026-106288

A missing authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553274076...

CVE-2026-106259

An incorrect authorization flaw was found in the PermissionElement component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/540076586...

CVE-2026-106249

An incorrect authorization flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552440317...

CVE-2026-106422

An incorrect authorization flaw was found in the API component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/519458746...

CVE-2026-106309

An incorrect authorization flaw was found in the Selection component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/503708636...

CVE-2026-81535

In wolfSSH versions prior to 1.5.1, a vulnerability exists when built with the --enable-fwd flag. The DoChannelOpen() function in src/internal.c only applies forwarding policy callbacks to direct-tcpip channel opens, allowing forwarded-tcpip opens to bypass authorization checks and remain uncappe...

CVE-2026-106471

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...