CVE-2026-65931

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-16279

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

CVE-2026-16279 Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

CVE-2026-16279

An Improper Authorization vulnerability affects 3DPassport within 3DSwymer , spanning 3DEXPERIENCE Releases R2023x through R2026x . The flaw could allow an attacker to gain access to some user accounts. The CNA-assigned CVSS 3.1 score is 9.3 (Critical) , with a network-based attack vector, low co...

CVE-2026-16279 Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

EUVD-2026-67137

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

Improper Authorization

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to delegated administrators being able to retrieve invitation registration links for non-existent email addresses, allowing them to create unauthorized user accounts and add them to an organization without the required use...

SUSE CVE-2026-66422

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 throu...

PT-2026-82508

Name of the Vulnerable Software and Affected Versions 3DPassport in 3DSwymer versions Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x Description An improper authorization issue exists in 3DPassport, which could allow an attacker to gain unauthorized access to certain user account...

PT-2026-82727

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated user possessing only the settings:read global permission can bypass authorization requirements to create new survey menu entries. This is achieved by directly invoking the...

CVE-2026-65931: Missing Authorization

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-16279: Improper Authorization

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

EUVD-2026-66217

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

CVE-2026-7487

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-3035

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035

GitLab EE is affected by an improper authorization check that allows an authenticated user with project Maintainer permissions to access the terminal of a protected environment they are not authorized to use, under certain conditions. The vulnerability affects versions from 11.3 before 19.1.7, 19...

EUVD-2026-66431

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-7487

GitLab EE is affected by an improper authorization check where the access control check is implemented after the asset is accessed . An authenticated user with reporter-role permissions who authored a merge request could reset merge request approval rules under certain conditions. The vulnerabili...

CVE-2026-7487 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...