CVE-2026-62113: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

PT-2026-96557

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996 mcu get eeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le3...

PT-2026-90229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the RISC-V KVM implementation. The SBI PMU EVENT GET INFO stores the product of a guest-controlled num events variable and the size of the event info...

PT-2026-90166

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra241 vintf init vsid function where a guest-provided virtual Stream ID vSID is programmed into the SID MATCH register. The hardware only supports a 20-bit Stre...

CVE-2026-79723

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...

CVE-2026-78571

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

CVE-2026-68527 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

EUVD-2026-42936

Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation...

praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

Target: PraisonAI MervinPraison/PraisonAIAffected component: praisonaiagents/tools/astgreptool.py — astgreprewriteAffected versions: master at ce97667156a116c50b4a3d1aa21e09f048903fda; reproduced against the current praisonaiagents PyPI release praisonaiagents = 1.6.52. SummaryTools in...

CVE-2026-88274

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

EUVD-2026-75272

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

CVE-2026-82582

An authorization bypass vulnerability in SHIRASAGI groupware allows an attacker with low privileges to retrieve files from the shared file feature by manipulating a user-controlled key. The root cause is the reliance on a user-supplied key for access control in the shared file module, enabling un...

CVE-2026-82582

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature...

EUVD-2026-75269

A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file...

CVE-2026-84062

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product...

CVE-2026-84062

BurgerEditor (a web content management product by D-zero) versions 3.0.0 through 3.4.0 are affected by an authorization bypass caused by a user-controlled key. An attacker with low-level authentication (existing user account) can exploit this over the network to alter page content , resulting in ...

CVE-2026-84062

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product...