Entra ID Elevation of Privilege Vulnerability

Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network...

Chromium: CVE-2026-84328 Missing authorization in FileSystem

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-84323 Missing authorization in FileSystem

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Microsoft Fabric Elevation of Privilege Vulnerability

Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

Data Sharing Service Client Elevation of Privilege Vulnerability

Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally...

Microsoft Office SharePoint Remote Code Execution Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-73318 XenForo < 2.3.13 Missing Authorization via force-agreement Controller

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation...

EUVD-2026-72755

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation...

CVE-2026-73318

XenForo versions before 2.3.13 contain a missing authorization flaw in the force-agreement controller . Any ACP administrator can access and submit force-agreement forms regardless of their assigned permissions, bypassing the option permission declared in the navigation configuration. This allows...

CVE-2026-73318 XenForo < 2.3.13 Missing Authorization via force-agreement Controller

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation...

CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

EUVD-2026-72754

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

CVE-2026-73317

XenForo before 2.3.13 contains a missing authorization flaw in the ACP cache-rebuild dispatcher . An administrator holding only the rebuildCache permission can supply an arbitrary job class and actor user ID in the POST body to invoke the approval queue job under any user identity, thereby approv...

CVE-2026-77106

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

EUVD-2026-72732

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-77106

Cvlaunchd , a component of Commvault , contained a missing authorization flaw in its command execution logic, allowing a low-privileged, network-based attacker (with present attack requirements and high complexity) to execute unauthorized commands. The vulnerability carries a CVSS v4.0 base score...

CVE-2026-77106 Cvlaunchd Code Execution

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-77106 Cvlaunchd Code Execution

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...