PT-2026-118328

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...

PT-2026-118424

Name of the Vulnerable Software and Affected Versions Booktics versions prior to 1.0.31 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to version 1.0.31 or later...

PT-2026-118635

Name of the Vulnerable Software and Affected Versions Kiro Crew versions prior to 0.7.2 Description Missing authorization in the WhatsApp group channel allows a remote actor who is a member of an operator-configured WhatsApp group to control other agent sessions of the operator. This occurs becau...

PT-2026-118332

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...

PT-2026-118422

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.26 Description A missing authorization flaw in the wp-user-manager plugin allows for the manipulation of user states. Recommendations Update to version 2.9.26 or later...

CVE-2026-107366 Langflow OSS Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session...

CVE-2026-107366

IBM Langflow OSS versions 1.0.0 through 1.12.4 are vulnerable to an authorization bypass (CWE-639) because three message endpoints fail to perform ownership verification. This flaw allows any authenticated user to perform unauthorized actions, including bulk-deleting another user's messages, over...

CVE-2026-112776

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776

Craft CMS versions 5.0.0 through 5.11.0 are vulnerable to a GraphQL Site-Scope Bypass via mutations. The root cause is the failure to enforce the requireAllowedSite() function, allowing site-scoped GraphQL tokens to interact with content from other sites. An attacker holding a valid token for one...

EUVD-2026-104582

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-84178

CVE-2026-84178 — camel-oauth: authorization-code callback login CSRF missing state Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the OAuth authorization-code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

CVE-2026-18329

A flaw was found in NGINX. When the NGINX JavaScript njs or QuickJS qjs engines process asynchronous request bodies, an exception during access-control evaluation can cause the jsaccess phase to fail open before an explicit denial is returned. An unauthenticated remote attacker can exploit this b...

CVE-2026-17183

A flaw was found in Grafana's Unified Alerting component. An authenticated user with permissions to create or edit alert rules in a folder can bypass datasource query permissions. By manipulating the queryType field, an attacker can execute queries against datasources they are not authorized to...

CVE-2025-10149

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...

EUVD-2025-211118

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...

Exploit for CVE-2026-85251

CVE-2026-85251 — camel-http: credential disclosure on redirect...

CVE-2026-109431

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

CVE-2026-109433

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...