PT-2026-113332

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

PT-2026-113036

Name of the Vulnerable Software and Affected Versions Windows Update Stack affected versions not specified Description Improper access control allows an authorized attacker to perform local tampering, which can affect the system. Recommendations At the moment, there is no information about a newe...

CVE-2026-70217: Improper Access Control

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-63153: Authorization Bypass Through User-Controlled Key

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

CVE-2026-63172: Missing Authorization

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight enforcement in...

Microsoft Windows: CVE-2026-83854: Windows Notification Information Disclosure Vulnerability

Improper access control in Windows Notification allows an authorized attacker to disclose information locally...

EUVD-2026-98960

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input...

CVE-2026-96316: Missing Authorization

Improper access control in Windows Routing and Remote Access Service RRAS allows an authorized attacker to perform tampering locally...

CVE-2026-108388: Incorrect Authorization

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

PT-2026-112893

Improper access control in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88072: Windows Host Guardian Service Elevation of Privilege Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...

CVE-2026-108492: Missing Authorization

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3...

Microsoft SharePoint: CVE-2026-102860: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-96237: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network...

PT-2026-111322

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3...

CVE-2026-52394: Insertion of Sensitive Information Into Sent Data

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input...

PT-2026-111689

Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration for WooCommerce: from n/a through 1.0.3...

PT-2026-111317

Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4...

PT-2026-112620

Improper access control in Windows Notification allows an authorized attacker to disclose information locally...

CVE-2026-102250: Insufficient Verification of Data Authenticity

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...