CVE-2026-63163

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5filename token instead of passing a proper authorization check. Attackers can guess or determi...

CVE-2026-63153

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

CVE-2026-106630

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...

CVE-2026-105443 IBM WebSphere Application Server Liberty is affected by an improper access control

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install...

CVE-2026-105443

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by an improper access control vulnerability (CWE-284) characterized by insufficient isolation between servers sharing an installation. This issue specifically impacts instances with the restConnector-1.0 or ...

CVE-2026-63172

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight enforcement in...

CVE-2026-63172 Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight enforcement in...

EUVD-2026-100582

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight enforcement in...

CVE-2026-63174 Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers ca...

CVE-2026-63174

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers ca...

CVE-2026-63174 Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers ca...

EUVD-2026-100580

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers ca...

CVE-2026-63174 Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers ca...

CVE-2026-63174

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a broken access control vulnerability. The issue stems from a missing readRight() check within the import flow's join INSERT, which allows the spaceAffectList affectation to occur without verifying the caller's rights to the targ...

CVE-2026-63153 Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

CVE-2026-63153 Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

CVE-2026-63153 Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

CVE-2026-63153

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

EUVD-2026-100579

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

CVE-2026-63153

The Omnispace Agora Project versions prior to 26.10.0 are susceptible to a broken access control vulnerability within the setAffectations() function. This flaw allows authenticated attackers to insert access-right records for a target space provided by the caller without the system verifying if t...