CVE-2026-71505

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71505

Dolibarr before 24.0.0 is affected by a Broken Object-Level Authorization (BOLA) vulnerability in the REST API third-party site account write routes . Per-object access checks are enforced only on read routes, leaving write endpoints unguarded. An authenticated attacker holding third-party creati...

CVE-2026-71505 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

EUVD-2026-65078

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71505 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-76205

creationtimestamp| type| source ---|---|--- 2026-08-24 17:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3405 2026-08-25 00:00:22+00:00| published-proof-of-concept| https://t.me/bdufstecru/3405...

CVE-2026-77915

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...

CVE-2026-57897

A flaw was found in Gitea. This vulnerability allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job Application Programming Interfaces APIs. An attacker could exploit this to gain unauthorized access to sensitive information across different repositories...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Fixed the incorrect assignment of a signed error value to unsigned fwlevel. Although the acpifindlastcachelevel function always returns a signed value, and the documentation states that it will return any errors...

CVE-2026-78255

creationtimestamp| type| source ---|---|--- 2026-08-24 08:31:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hy4p6mf2rxbjw...

CVE-2026-71507: Authorization Bypass Through User-Controlled Key

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71505: Authorization Bypass Through User-Controlled Key

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-32478: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-78272: Missing Authorization

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78266: Missing Authorization

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-32559: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-27364: Missing Authorization

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

PT-2026-81002

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A broken object-level authorization issue exists in the REST API company bank account write routes. This allows authenticated attackers with third-party creation rights to create, replace, or delet...

CVE-2026-32561: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

Aegis aegis-v0.13.0-alpha

AEGIS OS-level oversight for AI coding agents Open-source monitor that shows what AI coding agents actually do on your machine — at the OS level, no agent hooks required. AEGIS sees every AI agent on your machine — even ones that don't cooperate. It is an independent, OS-level observer that watch...