CVE-2026-19121

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected by a vulnerability where improper authorization allows an authenticated attacker to gain unauthorized access. The root cause is that the tenant context is not sufficiently verified against the authenticated user, potentially enabling...

CVE-2026-17428

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are impacted by multiple vulnerabilities stemming from improper authorization . A remote authenticated attacker can exploit this by providing values in the request URL that are used in authorization decisions withou...

CVE-2026-17381

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities. A remote authenticated attacker can obtain sensitive information because of improper authorization validation when using user-controlled keys (CWE-639). The CVSS 3.1 score i...

CVE-2026-17375

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are impacted by multiple vulnerabilities where a remote authenticated attacker could obtain sensitive information. The root cause is improper authorization, as authorization decisions rely on information supplied by...

CVE-2026-17373

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities. These flaws stem from improper authorization , which could allow a remote authenticated attacker to obtain sensitive information . The impact is rated as High with a CVSS 3....

CVE-2026-17334

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities that could allow a remote authenticated attacker to obtain sensitive information . The root cause is identified as improper authorization involving user-controlled keys (CWE-639). The CVSS 3.1 score is 8.5...

CVE-2026-17319

IBM API Connect versions v12.1.0.0 through v12.1.1.2 are vulnerable to a denial of service (DoS) condition due to improper authorization (CWE-862 ). A remote authenticated attacker can exploit this by providing client-supplied information that the system relies on to determine user permissions, a...

CVE-2026-17318

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to multiple vulnerabilities. A remote authenticated attacker could exploit improper authorization (CWE-639) to obtain sensitive information . The vulnerability has a CVSS 3.1 base score of 7.7 (High)...

CVE-2026-17241

The IBM API Connect software versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities. These flaws stem from improper authorization , which could allow a remote authenticated attacker to obtain sensitive information . The vulnerability is associat...

CVE-2026-17236

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities where a remote authenticated attacker could obtain sensitive information . The root cause is improper authorization because checks are not applied when certain organization U...

CVE-2026-16712

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are impacted by multiple vulnerabilities where a remote authenticated attacker could obtain sensitive information from other tenants . The root cause is improper authorization because identifiers supplied in request...

Modoboa < 2.1.0 - Improper Authorization

Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. id: CVE-2023-2227 info: name: Modoboa 2.1.0 - Improper Authorization author: ritikchaddha,princechaddha severity: critical description: | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. impact:...

WordPress Easy Student Results <=2.2.8 - Improper Authorization

WordPress Easy Student Results plugin through 2.2.8 is susceptible to information disclosure. The plugin lacks authorization in its REST API, which can allow an attacker to retrieve sensitive information related to courses, exams, and departments, as well as student grades and information such as...

Jira - Incorrect Authorization

Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access. id: CVE-2019-3403...

Tenda AC1200 V-W15Ev2 - Authentication Bypass

The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The...

CVE-2026-123676

A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapter...

CVE-2026-123676

The xxyopen/201206030 novel software (versions up to 3.5.0 ) is vulnerable to an improper authorization issue in the Book Content Service component. Specifically, the BookServiceImpl.getBookContentAbout function in src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java fails to p...

EUVD-2026-118312

A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapter...

CVE-2026-123664

A security flaw in nasa-gcn gcn.nasa.gov (up to commit b299b562af665878964b981a459f0a9c04b11adf ) affects the Email Notification Handler component. The vulnerability arises from improper processing of the /user/email file, where manipulating the Recipient argument leads to improper authorization ...

EUVD-2026-118271

A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper...