CVE-2026-110527: Improper Access Control

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...

Linux Distros Unpatched Vulnerability : CVE-2026-110111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the...

Linux Distros Unpatched Vulnerability : CVE-2026-9268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

CVE-2026-111914: Missing Authorization

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

Linux Distros Unpatched Vulnerability : CVE-2026-108082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7,...

CVE-2026-111044

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

CVE-2026-111044

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

EUVD-2026-103189

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

CVE-2026-108372

Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, "loopx serve-status" in "loopx/statusserver.py" uses "StatusRequestHandler.sendjson" and "doOPTIONS" to send "Access-Control-Allow-Origin: " for...

CVE-2026-69080 Apache Kylin: Broken Access Control in QuerySQLBlacklistController

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-69080 Apache Kylin: Broken Access Control in QuerySQLBlacklistController

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-69080

Apache Kylin versions 4 through 5.0.4 are vulnerable to a Broken Access Control flaw in the QuerySQLBlacklistController component. This security oversight allows an unauthorized actor to access the SQL Black List , leading to the exposure of sensitive information. To remediate this vulnerability,...

CVE-2026-17068

IBM i versions 7.3, 7.4, 7.5, and 7.6 are vulnerable to a bypass of Network File System (NFS) version restrictions. The root cause is the improper enforcement of the export version flag , which could allow a local attacker to bypass these restrictions (CWE-285). To remediate this, users should ap...

CVE-2026-17068 IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag...

CVE-2026-17068 IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag...

CVE-2026-17073 IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution...

CVE-2026-17073

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by an Improper Access Control vulnerability (CWE-284) within the Network File System (NFS) . A local attacker can obtain sensitive information because the system fails to perform subtree checks during file handle resolution. Remediation involves ...

CVE-2026-111716

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111690

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

CVE-2026-111676

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...