CVE-2026-112784 OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any...

CVE-2026-112784

The OpenCATS application, specifically versions before 0.10.0 , is vulnerable to a missing authorization flaw in the ajax/testEmailSettings.php component. This vulnerability allows any authenticated user with read-level privileges to send emails through the configured SMTP relay . Attackers can m...

EUVD-2026-104917

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...

EUVD-2026-104916

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any...

CVE-2026-112783 OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...

CVE-2026-112783

OpenCATS versions prior to 0.10.0 are vulnerable to a missing authorization flaw in the ajax/deleteActivity.php and ajax/editActivity.php endpoints. This vulnerability allows READ-level users to perform unauthorized actions by supplying an arbitrary activityID via GET or POST requests. Consequent...

EUVD-2026-104915

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 StudioCMS Privilege Escalation via Insecure API Token Generation NVD • Advisory • CWE-639 Overview The POST /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user at minimum Editor role to generate API tokens for any other user , including...

cve-2026-47777

CVE-2026-47777 — Mastodon Featured Collections Authorization Bypass Overview I responsibly disclosed a High Severity Authorization Bypass vulnerability affecting Mastodon's experimental Featured Collections federation pipeline. CVE ID: CVE-2026-47777 Affected Component...

CVE-2026-35273

🚨 CVE-2026-35273 - Oracle PeopleSoft PeopleTools Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in Oracle PeopleSoft PeopleTools A vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools that allows remote attackers to compromise vulnerable systems without...

API-Security-Checklist

繁中版 | 简中版 | العربية | Azərbaycan | Български | বাংলা | Català | Čeština | Deutsch | Ελληνικά | Español | فارسی | Français | हिंदी | Indonesia | Italiano | 日本語 | 한국어 | ພາສາລາວ | Македонски | മലയാളം | Монгол | Nederlands | Polski | Português Brasil | Русский | ไทย | Türkçe | Українська | Tiếng Việt...

nextjs-cve-demo

Example: Authorization Bypass in Next.js Middleware CVE-2025-29927 This Repo provides example projects demonstrating the Middleware authorization bypass vulnerability in Next.js CVE-2025-29927. This vulnerability allows unauthorized users to access protected resources. Vulnerability Overview...

CVE-2026-112065

The sgalinski Cookie Consent extension (sg_cookie_optin ) is vulnerable to a Missing Authorization (CWE-862) flaw. Specifically, the routes providing consent history and statistics data fail to verify if the authenticated backend user has the necessary permissions to access the module or the requ...

CVE-2026-112065 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation...

CVE-2026-112066

The sgalinski Cookie Consent (sg_cookie_optin) extension is vulnerable to a Missing Authorization flaw during the JSON import of cookie consent configurations. Specifically, the import process fails to validate the backend user's permissions, allowing non-admin backend users with module access to...

CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website...

CVE-2026-35045-PoC

CVE-2026-35045 — Broken Object-Level Authorization in Tandoor Recipes Summary The PUT /api/recipe/batchupdate/ endpoint in Tandoor Recipes v2.6.1 allows any authenticated user within a Space to modify any recipe in that Space — including private recipes owned by other users. This completely...

TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029...

TYPO3-EXT-SA-2026-029: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029...

CVE-2026-51119

CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25 Overview A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated low-privileged user can abuse this endpoin...