PT-2026-93702

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description A missing authorization issue exists in the onSale handler of the StoreProductController. This allows authenticated back-office users to modify the sale status of products without proper permission...

PT-2026-93701

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Authenticated back-office users can issue arbitrary invoices due to missing authorization in the CrmInvoiceController issueInvoice function. By calling the PUT '/admin-api/crm/invoice/issue'...

CVE-2026-92402: Missing Authorization

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack ca...

CVE-2026-92457: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify...

CVE-2026-92762: Missing Authorization

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-89030: Missing Authorization

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2ssearchuser AJAX handler in includes/Ajax/Get.php invokes B2STools::searchUser in includes/Tools.php, which returns the email address of every...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

CVE-2026-92783: Missing Authorization

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-82561: Missing Authorization

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-91732

A missing authorization flaw was found in the AppManifest component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511062248...

CVE-2026-91739

A missing authorization flaw was found in the Transactions Platform component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=521951328...

CVE-2026-91713

A missing authorization flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523715133...

CVE-2026-91717

A missing authorization flaw was found in the Android component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=549225472...

CVE-2026-82567 mySCADA myPRO Manager Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-82567 mySCADA myPRO Manager Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

CVE-2026-82567

mySCADA myPRO Manager exposes an unauthenticated HTTP endpoint in its notification gateway that accepts a phone number and message to send SMS via a connected GSM modem. Because no credentials are required, any attacker with adjacent network access can trigger arbitrary SMS messages through the d...

CVE-2026-73807

mySCADA myPRO Manager has a missing authorization vulnerability in its command API , which fails to properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API can reach privileged management functions, rated CVSS 3.1 9.8 (Critical...

CVE-2026-73807 mySCADA myPRO Manager Missing Authorization

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...

CVE-2026-73807 mySCADA myPRO Manager Missing Authorization

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...

CVE-2026-91739

Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...