CVE-2026-94254: Missing Authorization

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing...

PT-2026-114135

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/id/reviews to publish reviews and ratings attributed to...

CVE-2026-105975: Missing Authorization

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...

CVE-2026-94261: Authorization Bypass Through User-Controlled Key

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitra...

PT-2026-114072

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete...

CVE-2026-110769: Initialization of a Resource with an Insecure Default

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-110613: Authorization Bypass Through User-Controlled Key

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the omsorder table using a self-registered account to read order ids, ordersn values,...

PT-2026-113703

Name of the Vulnerable Software and Affected Versions Restricted Site Access versions prior to 7.6.3 Description A missing authorization issue in the 10up Restricted Site Access plugin allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to ...

PT-2026-114165

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1 Description An authorization bypass exists in the Agents create endpoint. The system accepts a caller-supplied Agent ID and verifies permissions only against the requested projec...

CVE-2025-71433: Missing Authorization

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...

PT-2026-114293

Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint /api/local-terminal that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control...

PT-2026-114053

Name of the Vulnerable Software and Affected Versions REBUILD versions REBUILD through 4.5.0 Description An authorization bypass exists in the AiBot2Controller /aibot2 endpoints. The system processes a caller-supplied chatid without verifying if the requester owns that ID. This allows authenticat...

PT-2026-114020

Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.29.1 mcp versions 2.0.0a1 through 2.0.1 Description The Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. ...

PT-2026-114231

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository, even when the RepoAdminChangeTeamAccess...

CVE-2026-102985: Missing Authorization

Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partialupdate places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's isactive field, including deactivating a project...

CVE-2026-107426: Missing Authorization

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-110620: Authorization Bypass Through User-Controlled Key

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70407): Gitea -- multiple vulnerabilities

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-110851: Authorization Bypass Through User-Controlled Key

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user...