CVE-2026-69252

Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...

CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-17070

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liman MYS: from 2.2.3 before 2.3.1...

CVE-2026-18650

CVE-2026-18650 describes a Missing Authorization vulnerability in HAVELSAN Liman MYS that allows privilege escalation. Affected: Liman MYS 2.2.3 prior to 2.3.1. CVSS v3.1 metrics indicate network access, low attack complexity, but user interaction not required, with privilegesRequired: LOW and hi...

EUVD-2026-52691

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1...

CVE-2026-18650 Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1...

CVE-2026-16546

The CVE-2026-16546 entry concerns the Wired Impact Volunteer Management WordPress plugin prior to 2.8.2. The issue is an authorization flaw in one AJAX action (wivm_remove_rsvp) that fails to verify that the RSVP being removed belongs to the requesting user. This permits users with a role as low ...

EUVD-2026-52531

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66326

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66311

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66326

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66311

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-67616

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-67616 Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-67616 Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-28147

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

EUVD-2026-52227

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

CVE-2026-28147 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

CVE-2026-15151

The CVE-2026-15151 issue affects the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. A missing capability check on an AJAX action (rtb_reset_notifications) allows users with the lowest booking-management role to reset the site’s configured booking notification rules. T...

CVE-2026-3141 FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...