Concrete CMS - User Enumeration

Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel concrete/controllers/panel/page/previewasuser.php. id: CVE-2026-18110 info: name: Concrete CMS - User Enumeration author: community severit...

candlepin: Consumer certificate can register systems in another organization

A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...

CVE-2026-111456: Red Hat: A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module…

A missing authorization check has been found in ConsumerResource.setupOwner function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate...

CVE-2026-109808

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

CVE-2026-109808 Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

EUVD-2026-120690

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

CVE-2026-109808

The SAP Solution Tools Plug-In (ST-PI) is vulnerable to a missing authorization check in certain remote-enabled functionality. An authenticated attacker who possesses prior knowledge of specific internal identifiers can exploit this flaw to access restricted data. This vulnerability results in a ...

CVE-2026-109808 Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

CVE-2026-109795 Missing authorization check in S4CRM

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected syste...

CVE-2026-109808: SAP_SE SAP Solution Tools Plug-In (ST-PI): Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an…

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

PT-2026-141255

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must ha...

CVE-2026-77385

A flaw was found in Kyoo, a self-hosted media server. A registered user with specific permissions could exploit a missing authorization check in the transcoder by supplying a specially crafted filesystem path. This vulnerability allows the user to retrieve uncataloged files, such as hidden or...

CVE-2026-122316

A flaw was found in Kyverno. A missing authorization check in the mutate-existing background processor allows an authenticated user with access to a specific namespace to modify resources outside their assigned boundary. By deploying a mutating policy that targets external resources, an attacker...

CVE-2026-62279

A flaw was found in LubeLogger. An authenticated user could exploit a missing authorization check in the DuplicateRecordsToOtherVehicles endpoint. This vulnerability allows the user to copy vehicle maintenance and fuel mileage records belonging to other users into their own vehicle. This leads to...

CVE-2026-110621

A flaw was found in Swetrix Cloud. A missing authorization check allows an authenticated remote attacker to take control of arbitrary projects by linking them to their own organization. By supplying a victim project's public tracking identifier, an attacker can access sensitive analytics data,...

CVE-2026-76152

Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via...

CVE-2026-73580

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and...

CVE-2026-76150

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content vi...

EUVD-2026-117488

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content vi...

CVE-2026-118624

A flaw was found in MLflow. An authenticated remote attacker can exploit a missing authorization check within the Tracking Server Jobs functionality, specifically in the findvalidator function. Successful exploitation allows the attacker to access and disclose sensitive information in the context...