EUVD-2026-109298

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

CVE-2026-116008

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to...

CVE-2026-116010

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2026-116010 RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2026-116010 RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2026-116010

RosarioSIS versions prior to 12.9.1 are susceptible to a missing authorization vulnerability. Authenticated teachers can manipulate records for students outside their assigned course periods by providing arbitrary student IDs. Specifically, an attacker can modify the st_arr, values, or attendance...

EUVD-2026-109268

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the starr, values, or attendance POST arrays in MakeReferral.php,...

CVE-2026-116008 DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to...

CVE-2026-116008

DaybydayCRM versions through 2.2.1 are vulnerable to a missing authorization flaw in the ProjectsController::updateAssign() function. The vulnerability allows any authenticated user to bypass the can-assign-new-user-to-project permission. By sending PATCH or POST requests to /projects/updateassig...

EUVD-2026-109266

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to...

CVE-2026-116008 DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to...

EUVD-2026-109263

Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13...

CVE-2026-110892

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

EUVD-2026-109254

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

PT-2026-122565

Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13...

PT-2026-122591

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st arr, values, or attendance POST arrays in MakeReferral.php,...

PT-2026-122589

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to...

PT-2026-122662

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php...

CVE-2026-115373

A flaw was found in Incus. A missing authorization check on the operations endpoint allows an authenticated attacker with restricted project access to view operations belonging to other projects. By querying the endpoint with a known operation identifier, the attacker can access sensitive...

CVE-2026-93639

A missing authorization vulnerability in Zimbra Collaboration Suite ZCS allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the pro...