CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

EUVD-2026-78813

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

CVE-2026-18421: Missing Authorization

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

PT-2026-92399

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, update data source, and delete data source, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the...

CVE-2026-91774: Missing Authorization

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

PT-2026-93117

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The software fails to perform session checks and lacks authorization on state-changing CGIs Common Gateway Interfaces, which are scripts used to interface extern...

WordPress Design Scuole Italia plugin 1.0-2.17.3 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by ? in WordPress Theme Design Scuole Italia versions 1.0-2.17.3...

CVE-2026-53966: Missing Authorization

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

CVE-2026-56827: Missing Authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

PT-2026-92393

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send to top and send to bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-68530: Missing Authorization

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

PT-2026-93150

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in AppManifest allows a remote attacker who has compromised the renderer process and used social engineering to bypass the web origin policy through a crafted HTML...

PT-2026-93157

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in the Transactions Platform allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations...

PT-2026-93131

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Missing authorization in the Browser component allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations Updat...

PT-2026-93135

Name of the Vulnerable Software and Affected Versions Google Chrome for Android versions prior to 153.0.8010.47 Description A missing authorization mechanism allows a local attacker to obtain sensitive information through a co-installed application. Recommendations Update Google Chrome for Androi...

CVE-2026-90820

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such...

CVE-2026-90820 a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such...

CVE-2026-90820

a2aproject a2a-java 1.2.0 contains a missing authorization flaw in the AuthorizationRequestHandlerDecorator.onListTasks function (file: server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java). The vulnerability allows a remote attacker with...

CVE-2026-90820 a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such...

CVE-2026-90820 a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such...