CVE-2026-55065: Improper Authorization

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...

CVE-2026-82281: Authorization Bypass Through User-Controlled Key

Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...

CVE-2026-81729

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

CVE-2026-30047

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30046

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30046

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30047

The Open5GS v2.7.6 software contains a reachable assertion vulnerability within the /nsmf-pdusession/v1/sm-contexts component. This flaw allows an attacker to trigger a Denial of Service (DoS) condition by submitting a specially crafted DELETE request . No specific remediation instructions, explo...

CVE-2026-30047

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

EUVD-2026-67103

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

PT-2026-82519

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

EUVD-2026-67104

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

PT-2026-82520

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30046

The Open5GS v2.7.6 software contains a reachable assertion vulnerability within the NUDM-UECM interface . An attacker can exploit this flaw by supplying a crafted DELETE request , which leads to a Denial of Service (DoS) . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided i...

CVE-2026-30046

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30047

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-81729: Incorrect Authorization

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

CVE-2026-30046: Reachable Assertion

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30047: Reachable Assertion

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-81202 itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication

A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed fr...

CVE-2026-81035

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls...