EUVD-2026-103060

sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys...

CVE-2026-111638

The sshportal software (versions through 1.19.5 ) is vulnerable to a missing authorization flaw in the management shell's key show command. This vulnerability allows authenticated non-admin users to retrieve decrypted backend private SSH keys by requesting predictable names such as default or hos...

EUVD-2026-103053

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

CVE-2026-111631 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

CVE-2026-111631

Distributor versions before 2.3.2 are vulnerable to a missing authorization flaw in external connection AJAX actions. This allows users with Contributor-level privileges to perform actions reserved for manage_options users. Specifically, an attacker can invoke dt_verify_external_connection with a...

EUVD-2026-103046

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

CVE-2026-111624

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

CVE-2026-111624

Umbraco CMS versions before 17.7.1 and 18.2.1 are affected by a missing authorization vulnerability in the PreviewHub and BackofficeHub SignalR hubs. Due to this flaw, unauthenticated clients can connect to these hubs and complete the SignalR negotiate step. This allows attackers to receive refre...

CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

EUVD-2026-103047

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajaxpush that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on site...

CVE-2026-111625

The 10up Distributor software (versions before 2.3.2 ) contains a missing authorization vulnerability within the ajax_push() function. This flaw allows Contributor-level multisite users to publish posts on other network sites to which they do not have access. By utilizing a dt-push nonce combined...

CVE-2026-111621 TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

EUVD-2026-103043

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111621

The TDuck Survey Form software (versions through 5.3 ) is vulnerable to a missing authorization flaw (CWE-639) in the /user/form/setting/{key} endpoint. This vulnerability allows any authenticated user to access the raw form settings of other owners by providing an 8-character form key obtained f...

CVE-2026-111610 B3log Solo through 4.4.0 Missing Authorization in ArticleConsole

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

EUVD-2026-103032

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

CVE-2026-111610 B3log Solo through 4.4.0 Missing Authorization in ArticleConsole

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

CVE-2026-111610

B3log Solo versions through 4.4.0 are vulnerable to a missing authorization flaw in the ArticleConsole component. The root cause is the omission of per-author ownership checks, which allows authenticated authors to access articles belonging to others. Specifically, an attacker can query the conso...

EUVD-2026-103028

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person,...