CVE-2026-96603: Missing Authorization

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirmloggedin/confirmuser of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The...

Penpot 2.17.2 Arbitrary File Overwrite

Penpot versions 1.20 through 2.17.2 contain a missing authorization vulnerability in the file import RPC command. An authenticated attacker can supply the identifier of another user's file to overwrite its contents and re-parent the file into an attacker-controlled project, resulting in file...

Linux Distros Unpatched Vulnerability : CVE-2026-91717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-install...

Linux Distros Unpatched Vulnerability : CVE-2026-91713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements...

Linux Distros Unpatched Vulnerability : CVE-2026-91739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spo...

CVE-2026-18177: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks...

Linux Distros Unpatched Vulnerability : CVE-2026-95287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site...

Linux Distros Unpatched Vulnerability : CVE-2026-95296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin...

Linux Distros Unpatched Vulnerability : CVE-2026-95371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Views. CVE-2026-95371 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable,...

Linux Distros Unpatched Vulnerability : CVE-2026-95278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WakeLock. CVE-2026-95278 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenabl...

Linux Distros Unpatched Vulnerability : CVE-2026-95285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to...

Linux Distros Unpatched Vulnerability : CVE-2026-95297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

CVE-2026-76648: Missing Authorization

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

CVE-2026-84719: Missing Authorization

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...

CVE-2026-87979: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-66075: Missing Authorization

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...

CVE-2026-95513: Missing Authorization

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...

PT-2026-97203

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB versions prior to 2.1.0 Description The plugin fails to properly verify if a user is authorized to perform specific actions. This missing authorization allows authenticated attackers with Contributor-level access or...

Linux Distros Unpatched Vulnerability : CVE-2026-95300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access...

GitLab 18.7 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-92470)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated...