CVE-2026-81922: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-18110: Missing Authorization

Concrete CMS 9 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to t...

CVE-2026-54076: Missing Authorization

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-66887: Missing Authorization

The affected products are missing authorization on state-changing CGIs and session checks are not performed...

CVE-2026-82567: Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

PT-2026-93131

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in the Browser component allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations Updat...

PT-2026-93157

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in the Transactions Platform allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations...

PT-2026-93135

Name of the Vulnerable Software and Affected Versions Google Chrome for Android versions prior to 153.0.8010.47 Description A missing authorization mechanism allows a local attacker to obtain sensitive information through a co-installed application. Recommendations Update Google Chrome for Androi...

PT-2026-92413

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action BackendPageMultilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

PT-2026-91833

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

PT-2026-93150

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in AppManifest allows a remote attacker who has compromised the renderer process and used social engineering to bypass the web origin policy through a crafted HTML...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

EUVD-2026-78813

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

PT-2026-93117

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The software fails to perform session checks and lacks authorization on state-changing CGIs Common Gateway Interfaces, which are scripts used to interface extern...

WordPress Design Scuole Italia plugin 1.0-2.17.3 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by ? in WordPress Theme Design Scuole Italia versions 1.0-2.17.3...

CVE-2026-53966: Missing Authorization

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-56827: Missing Authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

PT-2026-92393

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send to top and send to bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-68530: Missing Authorization

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-90820

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such...