116477 matches found
EUVD-2026-104917
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...
EUVD-2026-104915
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...
CVE-2026-112783
OpenCATS versions prior to 0.10.0 are vulnerable to a missing authorization flaw in the ajax/deleteActivity.php and ajax/editActivity.php endpoints. This vulnerability allows READ-level users to perform unauthorized actions by supplying an arbitrary activityID via GET or POST requests. Consequent...
CVE-2026-112783 OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...
CVE-2026-112783 OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...
CVE-2026-112065 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation...
CVE-2026-112065
The sgalinski Cookie Consent extension (sg_cookie_optin ) is vulnerable to a Missing Authorization (CWE-862) flaw. Specifically, the routes providing consent history and statistics data fail to verify if the authenticated backend user has the necessary permissions to access the module or the requ...
CVE-2026-112066
The sgalinski Cookie Consent (sg_cookie_optin) extension is vulnerable to a Missing Authorization flaw during the JSON import of cookie consent configurations. Specifically, the import process fails to validate the backend user's permissions, allowing non-admin backend users with module access to...
CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...
TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029...
TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029...
CVE-2026-96903
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
EUVD-2026-104801
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...
CVE-2026-105299
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstreamrequestfilter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Sectio...
CVE-2026-86977
An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages...
CVE-2026-86976
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data...
CVE-2026-86955
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data...
CVE-2026-86932
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data...
CVE-2026-86907
An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain...