CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-64859

In new-api before v1.0.0-rc.7, the User model's AccessToken field was serialized as "access_token" in JSON responses to admin-only endpoints (GET /api/user/ and user lookup). An authenticated admin could retrieve the root user's bearer token and impersonate root, bypassing role boundaries to acce...

CVE-2026-15754

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-15754

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-16047 Board channel linking without read channel permission validation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

CVE-2026-16047

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

CVE-2026-16471

Sonlogger v6.6.6 up to 6.7.4.7 has a missing-authorization flaw allowing unauthenticated remote users to access ACL-unconstrained functionality with high confidentiality impact. CVSS 7.5 (network, low complexity, no auth). SSVC notes no known exploitation. Upgrade to 6.7.4.8. Turkey's Siber Güven...

CVE-2026-16471 Broken Access Control in Dolusoft Software's Sonlogger

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8...

CVE-2026-16467 Broken Access Control in Dolusoft Software's Fortilogger

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9...

CVE-2026-16467

FortiLogger versions before 6.1.5.9 have a broken access control flaw allowing unauthenticated remote attackers to access restricted functionality, exposing sensitive log data. CVSS 7.5 HIGH. Exploitation status is not provided. Upgrade to 6.1.5.9 or later. Reference: https://siberguvenlik.gov.tr...

CVE-2026-16467 Broken Access Control in Dolusoft Software's Fortilogger

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9...

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

PT-2026-76825

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0 Description Authenticated users can bypass experiment-level READ permissions to access arbitrary files from another user's artifact directory. The issue occurs because the validate source run and validate source...

PT-2026-76835

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/user group id and POST /manage/admin/user-group/user group id/add-users endpoints in ee/onyx/server/user group/api.py call update user group and add users to user group in ee/onyx/db/user...

PT-2026-76877

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description The Boards plugin fails to enforce the PermissionManageBoardRoles authorization on the channelId field...

LightRAG <= 1.5.4 - Missing Authentication

LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access. id:...

CVE-2026-19717

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders whi...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19728

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...