CVE-2026-75108

Next Terminal is vulnerable due to missing per-asset authorization checks on its portal ping and wake-on-LAN endpoints . Any authenticated user (PR:L) can supply arbitrary asset IDs to retrieve unauthorized asset metadata (display names, reachability, network addresses) or trigger wake-on-LAN pac...

CVE-2026-75108 Next Terminal Missing Per-Asset Authorization on Portal Endpoints

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103

Crawlab 's password-change endpoint (core/controllers/user_v2.go) lacks authorization checks, so any authenticated user can reset any account's password. Combined with account enumeration via the user listing endpoint, attackers can compromise admin credentials to achieve full account takeover an...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/resetpasskey, allowing a lower-privileged...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75044

In JetBrains YouTrack before versions 2025.3.156085, 2026.1.13914, and 2026.2.18095, a missing authorization check on the mailbox endpoint allowed any authenticated user to delete arbitrary entities, causing high integrity and availability impact (CVSS 8.1). No in-the-wild exploitation is reporte...

EUVD-2026-60243

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-16471

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8...

CVE-2026-16467

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9...

CVE-2026-16471 Broken Access Control in Dolusoft Software's Sonlogger

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8...

CVE-2026-16471

Sonlogger v6.6.6 up to 6.7.4.7 has a missing-authorization flaw allowing unauthenticated remote users to access ACL-unconstrained functionality with high confidentiality impact. CVSS 7.5 (network, low complexity, no auth). SSVC notes no known exploitation. Upgrade to 6.7.4.8. Turkey's Siber Güven...

EUVD-2026-60176

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8...

CVE-2026-16467

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9...

CVE-2026-16467 Broken Access Control in Dolusoft Software's Fortilogger

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9...

EUVD-2026-60173

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9...

CVE-2026-16467

FortiLogger versions before 6.1.5.9 have a broken access control flaw allowing unauthenticated remote attackers to access restricted functionality, exposing sensitive log data. CVSS 7.5 HIGH. Exploitation status is not provided. Upgrade to 6.1.5.9 or later. Reference: https://siberguvenlik.gov.tr...

CVE-2026-16467 Broken Access Control in Dolusoft Software's Fortilogger

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9...