Gitea Data Compromise

The vulnerability of the services/lfs/server.go and routers/private/serv.go files of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected...

CVE-2026-104449: Authorization Bypass Through User-Controlled Key

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

Missing Authentication in Brocade ASCGStreaming Service (CVE-2026-85421)

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

EUVD-2026-91758

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

PT-2026-104400

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes e.g., via the deleted-attributes search or the paginated attribute listing, the application returned soft-deleted attributes...

PT-2026-104349

Name of the Vulnerable Software and Affected Versions Airano MCP Bridge versions prior to 2.11.0 Description Missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update Airano MCP Bridge to version 2.11.0 or later...

CVE-2026-51915: Improper Access Control

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51904: Improper Access Control

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-39717: Missing Authorization

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10...

PT-2026-104425

Name of the Vulnerable Software and Affected Versions Phproject versions prior to 1.8.7 Description An issue exists in the REST API where object-level authorization is missing. Authenticated users with a valid API key can bypass the security.restrict access confidentiality control because the...

PT-2026-104338

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

PT-2026-104371

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete user knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledge id deletes the selected knowledge object without requiring authentication in the...

CVE-2026-51904

SuperAGI versions up to v0.0.14 are vulnerable to an improper access control vulnerability within the agent execution controller. Specifically, the functions create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id but fail to verify...

CVE-2026-51901: Improper Access Control

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

CVE-2026-104403: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...

PT-2026-104169

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.5.0 Description An authorization bypass exists due to a user-controlled key, which allows the exploitation of incorrectly configured access control security levels. Recommendations Update LearnPress to version...

Gitea ListMembers Disclosure

The vulnerability of the ListMembers function in the routers/api/v1/org/member.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Privilege Escalation

The vulnerability of the CreateAccessToken function in the routers/api/v1/user/app.go file and the reqBasicOrRevProxyAuth function in the routers/api/v1/api.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a...