PT-2026-117399

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to user or call mark as read with another user...

PT-2026-117375

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10...

PT-2026-117406

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix fs.root or fs.path to any directory to read...

PT-2026-117379

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0...

PT-2026-117378

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...

PT-2026-117400

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call sid values. Attackers can call the add note to call log and add task to call log endpoints to attach attacker-written notes an...

PT-2026-117381

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0...

PT-2026-117438

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

PT-2026-117437

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

PT-2026-117436

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal server token values and alert...

CVE-2026-112292: Missing Authorization

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/ /records endpoints to steal servertoken values and...

CVE-2026-112000

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and...

EUVD-2026-103453

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and...

CVE-2026-112000 Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and...

CVE-2026-112000

Vanus versions 0.8.0 through 0.9.0 are affected by a missing authorization vulnerability in the gateway. This flaw allows any authenticated user to invoke Subscribe , Ack , and unregistered methods without proper permission checks. An attacker can exploit this by providing another tenant's subscr...

CVE-2026-112000 Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and...

CVE-2026-112000 Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and...

CVE-2026-112000

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and...

CVE-2026-110880

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

CVE-2026-110365

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...