CVE-2026-68484: Missing Authorization

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges...

PT-2026-89080

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges...

CVE-2026-86804

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to...

CVE-2026-86804 seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to...

CVE-2026-86804

An improper authorization vulnerability in seakee CPA-Manager-Plus versions up to 1.11.10 affects the CPAResource function in the file apps/manager-server/internal/http/controller/proxy/handler.go within the HTTP Handler component. An unauthenticated remote attacker can manipulate this handler to...

EUVD-2026-74049

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to...

CVE-2026-86804 seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to...

CVE-2026-86804 seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to...

CVE-2026-58611

Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

EUVD-2026-73368

Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

CVE-2026-58611

CVE-2026-58611 is an improper authorization vulnerability in Xbox Gaming Services that allows an already-authorized (low-privilege) attacker to elevate privileges locally , resulting in high impact to confidentiality, integrity, and availability. The assigned CVSS 3.1 score is 7.8 (HIGH) with a l...

CVE-2026-86840

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...

CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container...

CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container...

CVE-2026-82062

MongoDB Server is affected by an improper authorization flaw in the applyOps command . An authenticated user with elevated internal privileges can bypass a disabled feature gate by specifying an internal replication mode value not intended to be client-selectable. This enables container operation...

CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container...

Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container...

EUVD-2026-72876

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...

CVE-2026-86840 Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...

CVE-2026-86840 Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...