CVE-2026-108550: Incorrect Authorization

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth...

CVE-2026-108671: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP...

CVE-2026-108581: Missing Authorization

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

PT-2026-109934

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the exportXls handler within the AiragPromptsController. This issue allows any authenticated user, including those with low privileges, to export all AI prompts from...

PT-2026-109885

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysMessageController. This issue allows authenticated users with low privileges to delete message push records, including those pendin...

PT-2026-109929

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteRecycleBin handler within the AiragPromptsController. This issue allows any authenticated user to purge AI prompt templates by sending DELETE requests to t...

PT-2026-109919

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryTenantAuthInfo handler within the SysTenantController. This issue allows any authenticated user to access records belonging to other tenants. Low-privileged...

PT-2026-109879

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can modify message templates due to missing authorization. By accessing the unguarded list endpoint to obtain template IDs, an attacker can use the PUT...

PT-2026-109937

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can download announcement attachments due to missing authorization in the SysAnnouncementController downLoadFiles handler. By providing a known announcement id, a...

PT-2026-109890

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the saveDatarule handler of the SysDepartPermissionController. This issue allows authenticated users with low privileges to modify department data rules by sending...

PT-2026-109927

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the AiragPromptsController. This issue allows any authenticated user to delete AI prompt templates. An attacker with low privileges can...

PT-2026-109665

Name of the Vulnerable Software and Affected Versions SkillHub versions prior to 0.2.22 Description An incorrect authorization issue exists within the AccountMergeService and AccountMergeController. Authenticated attackers can exploit the account merge flow to take over other accounts. By calling...

CVE-2026-105989: Missing Authorization

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

CVE-2026-105977: Authorization Bypass Through User-Controlled Key

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...

CVE-2026-105976: Incorrect Authorization

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters...

CVE-2026-104741: Missing Authorization

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-97670: Improper Control of Generation of Code

The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...

CVE-2026-108606: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every...

CVE-2026-108605: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

CVE-2026-108604: Incorrect Authorization

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...