EUVD-2026-105159

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...

CVE-2026-113359

The Baserow application before version 2.3.0 is vulnerable to a missing authorization flaw in the unique_row_values API endpoint. This vulnerability allows any authenticated user to perform a cross-workspace data disclosure by enumerating sequential field IDs. An attacker can successfully retriev...

CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113594

Sharkord versions before 0.0.8 are vulnerable to a missing authorization flaw in the others.updateSettings tRPC mutation. This allows any authenticated member to modify server-wide settings without the required MANAGE_SETTINGS permission. Exploitation can lead to a denial of service by allowing a...

CVE-2026-113411

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

CVE-2026-112834

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

EUVD-2026-105142

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

EUVD-2026-105141

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

EUVD-2026-105138

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30...

EUVD-2026-105131

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

CVE-2026-111764

The A2A Java SDK (versions prior to 1.3.0.Final ) contains a fail-open default task authorization vulnerability. The InMemoryTaskStore component's no-argument constructor sets the authorizationProvider to null, causing the get(String taskId) method to return tasks without verifying the caller or ...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

EUVD-2026-105130

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-111764 A2A Java SDK has a fail-open default task authorization

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

EUVD-2026-105041

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

EUVD-2026-105022

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

CVE-2026-113411 Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...

CVE-2026-113411 Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...