CVE-2026-110769: Initialization of a Resource with an Insecure Default

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-110613: Authorization Bypass Through User-Controlled Key

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the omsorder table using a self-registered account to read order ids, ordersn values,...

PT-2026-113703

Name of the Vulnerable Software and Affected Versions Restricted Site Access versions prior to 7.6.3 Description A missing authorization issue in the 10up Restricted Site Access plugin allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to ...

PT-2026-114165

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1 Description An authorization bypass exists in the Agents create endpoint. The system accepts a caller-supplied Agent ID and verifies permissions only against the requested projec...

CVE-2025-71433: Missing Authorization

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...

PT-2026-114293

Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint /api/local-terminal that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control...

PT-2026-114053

Name of the Vulnerable Software and Affected Versions REBUILD versions REBUILD through 4.5.0 Description An authorization bypass exists in the AiBot2Controller /aibot2 endpoints. The system processes a caller-supplied chatid without verifying if the requester owns that ID. This allows authenticat...

PT-2026-114020

Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.29.1 mcp versions 2.0.0a1 through 2.0.1 Description The Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. ...

PT-2026-114231

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository, even when the RepoAdminChangeTeamAccess...

CVE-2026-102985: Missing Authorization

Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partialupdate places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's isactive field, including deactivating a project...

CVE-2026-107426: Missing Authorization

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-110620: Authorization Bypass Through User-Controlled Key

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70407): Gitea -- multiple vulnerabilities

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassin...

CVE-2026-110851: Authorization Bypass Through User-Controlled Key

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user...

PT-2026-114243

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects...

Linux Distros Unpatched Vulnerability : CVE-2026-108726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they canno...

Google Chrome Microsoft Edge Web Authentication Passkeys Security Keys Access

The vulnerability in the Web Authentication component Passkeys and Security Keys of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability in the Browser component of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Paint Component Protected Information Access

The vulnerability in the Paint component of Google Chrome and Microsoft Edge web browsers is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...