CVE-2026-14237

The CVE-2026-14237 entry applies to the vitepos WordPress plugin before 3.6.0 and the Vitepos WordPress plugin before 3.5.0. The issue is that these plugins do not perform a per-target authorization check in their point-of-sale password-reset API, granting the custom Outlet Manager role an over-b...

CVE-2026-19350

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19350

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19345

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument taskid/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public...

CVE-2026-19345 code-projects Task Management System UpdateTaskStatus.php authorization

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument taskid/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public...

CVE-2026-18357 WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-16948

The CVE-2026-16948 entry documents a vulnerability in the Solace Extra WordPress plugin prior to version 1.6.1 where several AJAX actions lack proper capability checks and the admin nonce is exposed on pages reachable by low-privileged users. This permits users with a role as low as Subscriber to...

EUVD-2026-54738

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...

CVE-2026-54201

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...

CVE-2026-54201 TeamDavid: Missing Authorization

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...

CVE-2026-54201

The CVE-2026-54201 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. The issue: missing authentication/authorization when serving log files, enabling attackers to obtain sensitive error information or internal application details. Affected component: TeamDavid through Rollout 524. The vuln...

EUVD-2026-54321

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-65667

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62830

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-62830

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-65667

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-67621

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...

CVE-2026-67621 Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...

CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...