PT-2026-83702

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

CVE-2026-82225: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

PT-2026-84011

Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.7 Description Broken access control allows users with the subscriber role to perform unauthorized actions. Recommendations Update to a version newer than 2.7.6...

CVE-2026-78075: Authorization Bypass Through User-Controlled Key

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-51701

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-81758: Missing Authorization

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

PT-2026-84006

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions prior to 6.2.13 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 6.2.12...

CVE-2026-81296: Missing Authorization

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

PT-2026-83987

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...

PT-2026-84010

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-76133: Use of a Broken or Risky Cryptographic Algorithm

The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...

PT-2026-83948

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own list views and config edits enforce ownership, but the...

CVE-2026-51678

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-81762: Missing Authorization

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-19197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

EEF-CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Summary Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops...

CVE-2026-81643

CVE-2026-81643 is a broken access control flaw in ash_graphql (versions 1.4.0 through 1.10.0 ). In AshGraphql.Subscription.Batcher, the should_send?/1 authorization filter is applied only to the first notification in a batch; remaining notifications are appended to outgoing results without that f...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...