35847 matches found
CVE-2026-73014: Missing Authorization
Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally...
CVE-2026-81781: Missing Authorization
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
CVE-2026-73318: Incorrect Authorization
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation...
CVE-2026-12645: Missing Authorization
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
PT-2026-87418
Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Missing authorization allows an authorized attacker to elevate privileges over a network, which enables them to affect the system. Recommendations At the moment, there is no...
PT-2026-87063
Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...
CVE-2026-12646: Missing Authorization
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
PT-2026-87415
Name of the Vulnerable Software and Affected Versions Windows Modern Device Management MDM affected versions not specified Description Missing authorization in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is...
PT-2026-88643
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Core allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is a security featu...
PT-2026-87085
Name of the Vulnerable Software and Affected Versions Ivanti Neurons for ITSM versions prior to 2026.2 Description A missing authorization issue allows a remote authenticated attacker to execute arbitrary code on the server. Recommendations At the moment, there is no information about a newer...
CVE-2026-86731: Missing Authorization
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...
CVE-2026-12647: Missing Authorization
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...
PT-2026-88107
Name of the Vulnerable Software and Affected Versions Microsoft Azure Entra ID affected versions not specified Description Missing authorization in the Microsoft Azure Entra ID compatibility package allows an authorized attacker to elevate privileges over a network. Recommendations At the moment,...
WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability
Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event Solution versions = 4.1.22...
PT-2026-86997
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
PT-2026-87122
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...
PT-2026-88593
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user to...
CVE-2026-84869: Missing Authorization
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...
PT-2026-87062
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...