CVE-2026-111417

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service . The root cause is the use of a shared token for submitted conversion documents, which may allow unauthorized users to access documents submitted by others. While the vulnerability is conf...

EUVD-2026-112697

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

BIT-GITLAB-2026-14288 Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

Security update for rust-keylime

This update for rust-keylime fixes the following issue: CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers bsc1287921 CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification bsc1287921...

CVE-2026-99110

A flaw was found in the Linux kernel's Common Internet File System CIFS client. When converting a POSIX Access Control List ACL to the network wire format, the kernel verifies the ACL against an extended attribute size calculation instead of the larger network format size, leading to a heap-based...

CVE-2026-19610

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control RBAC...

CVE-2026-19610

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control RBAC...

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control

Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. id: CVE-2019-2578 info: name: Oracle Fusion...

EUVD-2026-112503

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

EUVD-2026-112491

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2026-51902

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/projectid allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts ...

PT-2026-132301

Name of the Vulnerable Software and Affected Versions Bulk Share : Location Sender version 2.1.0 Description Insecure permissions allow unauthorized attackers to invoke an exported component, enabling arbitrary data access and control over the internal data flow of the application. Recommendation...

EUVD-2026-113170

Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application...

CVE-2026-51903

SuperAGI v0.0.14 is vulnerable to an improper access control vulnerability within the get_agent_by_latest_execution function located in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can exploit this by supplying a victim project_id to the /agentexe...

CVE-2026-79589

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw. The vulnerability stems from the exposure of a UART debugging interface that lacks authentication, authorization, and access control functionality. An attacker with physical access can solder to and ...

CVE-2026-51905

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the get_agent_execution_configuration function located in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can access and read another organization's agent executi...

CVE-2026-51905

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in getagentexecutionconfiguration in superagi/controllers/agentexecutionconfig.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the...

EUVD-2026-113343

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in getagentexecutionconfiguration in superagi/controllers/agentexecutionconfig.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the...

CVE-2026-115706: Elastic Elastic Cloud Enterprise: Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege…

Authorization Bypass Through User-Controlled Key CWE-639 in Elastic Cloud Enterprise ECE can lead to privilege escalation via Privilege Abuse CAPEC-122. An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials ca...