CVE-2026-107568: Missing Authorization

Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...

CVE-2026-107566: Missing Authorization

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

CVE-2026-111439: Missing Authorization

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pgreadbinaryfileblocks 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 isrowdatafile...

CVE-2026-110363: Missing Authorization

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10...

CVE-2026-112262: Missing Authorization

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

CVE-2026-111831: Missing Authorization

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...

CVE-2026-103091: Missing Authorization

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-79633: Exposure of Sensitive Information Through Data Queries

vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

PT-2026-117254

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

PT-2026-117255

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...

PT-2026-117210

Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.8 Description Missing authorization and the use of insecure default resource initialization allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools...

PT-2026-117209

Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 Description Missing authentication and authorization in the /libp2p-http ingress server, specifically within the StartIngressServer function in cmd/sam-node/node.go, allow ...

VulnCheck KEV: CVE-2026-57727

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0...

PT-2026-117447

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

PT-2026-117455

Name of the Vulnerable Software and Affected Versions hMailServer versions 6.2.22 through 6.3.6 hMailServer versions 6.0.0 through 6.3.6 Description Missing authorization in the Sieve notify action and the mail-rule Reply action allows an authenticated user to send emails through the server using...

PT-2026-117399

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to user or call mark as read with another user...

PT-2026-117375

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10...

PT-2026-117406

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix fs.root or fs.path to any directory to read...

PT-2026-117379

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0...

PT-2026-117378

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...