PT-2026-110773

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description An authorization flaw exists in the PortsController::purge function. Users with global-read permissions can bypass authorization to physically delete ports without having the required delete...

PT-2026-111077

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.112.0 Description Authenticated users with a common operational role can modify records beyond their assigned permissions. This occurs due to missing validation in certain endpoints, allowing attackers to...

PT-2026-111057

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.0 Frappe ERPNext versions 16.x prior to 16.31.0 Description Certain endpoints fail to enforce proper authorization checks on valuation data. This allows authenticated low-privileged users to query these...

PT-2026-110938

Name of the Vulnerable Software and Affected Versions SnapOtter versions 1.15.10 through 2.2.0 Description A missing authorization issue allows any authenticated principal to access the '/api/v1/upload', '/api/v1/preview', and '/api/v1/preview/generate' endpoints without proper permission checks...

PT-2026-110944

Name of the Vulnerable Software and Affected Versions Shaark versions 1.2.13 through 1.2.44 Description Missing authorization in the Link, Story, Chest, and Album API controllers allows authenticated non-admin users to bypass ownership checks. By sending PUT or DELETE requests to the endpoints...

PT-2026-110733

Name of the Vulnerable Software and Affected Versions Grav Data Manager plugin versions 1.4.0 through 1.4.5 Description Missing authorization allows unauthenticated attackers to delete stored data files through the classic Admin integration. By sending a request containing the delete parameter...

PT-2026-110740

Name of the Vulnerable Software and Affected Versions Grav Star Ratings versions 2.0.1 through 2.0.3 Description Missing authorization allows unauthenticated visitors to cast votes by bypassing client-side vote access and readonly enforcement. An attacker can utilize the anonymous nonce provided ...

PT-2026-111067

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.0 Frappe ERPNext versions 16.x prior to 16.31.0 Description Authenticated attackers can trigger transactional emails for documents they are not permitted to read because certain endpoints fail to verify ...

PT-2026-110723

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.13 Description An authorization flaw exists in the actionSwitchToLicensedEdition function within the AppController. This issue allows any authenticated user to change the installed software edition...

CVE-2026-109306: Missing Authorization

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

CVE-2026-109171: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...

CVE-2026-109629: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lis...

PT-2026-110713

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.4 Description Authenticated users can access disabled model provider backends by providing an explicit backend index. This occurs on Ollama and OpenAI-compatible listing routes, where the index can be passed a...

CVE-2026-84315: Missing Authorization

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-109625: Missing Authorization

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

PT-2026-111017

Name of the Vulnerable Software and Affected Versions Frappe Framework versions prior to 15.120.0 Frappe Framework versions 16.x prior to 16.33.0 Description An authorization flaw exists in the whitelisted 'send sms' API endpoint. The system fails to verify if the caller has the necessary...

PT-2026-111072

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.113.0 Frappe ERPNext versions 16.x prior to 16.24.0 Description Certain endpoints fail to enforce proper permission checks. This allows authenticated users to access and read financial data that exceeds the...

PT-2026-111030

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.0 Description Authenticated users can read financial data beyond their permitted role due to missing authorization checks. This allows attackers to query endpoints to access sensitive financial records th...

CVE-2026-107418: Missing Authorization

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28...

PT-2026-110587

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions prior to 9.4 Description Authenticated users can access and modify unauthorized documents due to missing authorization in SoapDocumentService operations. By using sequential document IDs via SOAP or the...