PT-2026-70025

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve,...

PT-2026-70929

Name of the Vulnerable Software and Affected Versions cJSON versions 1.5.0 through 1.7.19 Description An incorrectly-resolved name or reference issue exists in the decode pointer inplace function within cJSON Utils.c. Unauthenticated attackers can cause JSON Patch operations to target incorrect...

PT-2026-70852

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an...

PT-2026-70914

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-70367

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network...

PT-2026-70352

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The...

PT-2026-70029

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description The WebSocket component of SAP Approuter fails to perform sufficient authorization checks within certain functionality. This allows an attacker with low privileges to access restricted...

PT-2026-70401

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Missing authorization allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a f...

PT-2026-70206

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content title, description, and attachments of tickets belonging to another company, to hijack another company's...

PT-2026-70797

Name of the Vulnerable Software and Affected Versions PeerTube versions prior to 8.2.2 Description PeerTube is an ActivityPub-federated video streaming platform. The processUpdateActivity and processUpdateVideo functions accept an ActivityPub Update containing a Video object without verifying tha...

PT-2026-70859

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...

PT-2026-70033

Name of the Vulnerable Software and Affected Versions SAP ABAP Development Tools affected versions not specified Description SAP ABAP Development Tools fails to perform required authorization checks for specific functionality. This allows an attacker with low privileges to execute unauthorized...

PT-2026-70067

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Missing authorization checks in the upload azure, upload sftp, and upload smb VQL plugins allow an authenticated user with the analyst role to initiate outbound network connections from...

PT-2026-70817

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

PT-2026-70835

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

PT-2026-70598

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description An authentication bypass via capture-replay allows an authorized attacker to elevate privileges over a network. This issue involves improper authorization and external contr...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

PT-2026-70602

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Missing authorization allows an authorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no information about a newer version...

PT-2026-70116

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update resource type endpoint. The endpoint omits the administrator permission check that the corresponding delete resource type...

PT-2026-70351

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this...