CVE-2026-109362: Insufficient Session Expiration

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or...

CVE-2026-21135: Undefined Security Weakness

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...

CVE-2026-21117: Undefined Security Weakness

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information...

CVE-2026-108795: Improper Access Control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-21118: Undefined Security Weakness

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...

CVE-2026-108486: Missing Authorization

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0...

CVE-2026-107418: Missing Authorization

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...

CVE-2026-1907: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-107863: Missing Authorization

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7...

CVE-2026-21139: Undefined Security Weakness

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...

CVE-2026-109332: Origin Validation Error

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-109177: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-97691: Improper Access Control

Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex...

CVE-2026-107427: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1...

PT-2026-110724

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.13 Description A DOM-based cross-site scripting issue exists in the control panel login and 2FA verification flow. The problem occurs because the returnUrl variable, which is controlled by the user, accept...

PT-2026-111001

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.3 Frappe versions 14.x prior to 14.21.1 Description Improper access control in Email Template permissions allows any authenticated non-guest user to create and edit any Email Template. This enables attackers with...

ROS-20261012-73-0149

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261012-73-0138

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261012-73-0080

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261012-73-0269

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...