CVE-2026-111624

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose conte...

CVE-2026-111624

Umbraco CMS versions before 17.7.1 and 18.2.1 are affected by a missing authorization vulnerability in the PreviewHub and BackofficeHub SignalR hubs. Due to this flaw, unauthenticated clients can connect to these hubs and complete the SignalR negotiate step. This allows attackers to receive refre...

CVE-2026-111621 TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111621 TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

EUVD-2026-103043

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111621

The TDuck Survey Form software (versions through 5.3 ) is vulnerable to a missing authorization flaw (CWE-639) in the /user/form/setting/{key} endpoint. This vulnerability allows any authenticated user to access the raw form settings of other owners by providing an 8-character form key obtained f...

CVE-2026-111610

B3log Solo versions through 4.4.0 are vulnerable to a missing authorization flaw in the ArticleConsole component. The root cause is the omission of per-author ownership checks, which allows authenticated authors to access articles belonging to others. Specifically, an attacker can query the conso...

CVE-2026-111610 B3log Solo through 4.4.0 Missing Authorization in ArticleConsole

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

EUVD-2026-103032

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

CVE-2026-111610 B3log Solo through 4.4.0 Missing Authorization in ArticleConsole

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

CVE-2026-111606 Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person,...

EUVD-2026-103028

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person,...

CVE-2026-111606

The Huly Platform versions through 0.7.432 are vulnerable to an account takeover due to a missing authorization flaw in the mergeSpecifiedPersons account RPC. This vulnerability allows any authenticated user who possesses two person UUIDs to graft attacker-controlled unverified social IDs onto a ...

CVE-2026-111606 Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person,...

EUVD-2026-103025

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...

CVE-2026-111603

PlayEdu versions through 2.3 are affected by a missing authorization vulnerability within the CourseController . The root cause is the omission of a department visibility check , which allows authenticated students to access department-restricted courses. Attackers can perform ID enumeration on s...

CVE-2026-111603 PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details an...

CVE-2026-97851

The J4Care dcm4che software contains a Missing Authorization vulnerability (CWE-862) within its storage status-change REST service . An attacker can modify location records associated with DICOM instances to a TO_DELETE state. This action triggers the PurgeStorageScheduler to delete the reference...

CVE-2026-97851 J4Care dcm4che Missing Authorization

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

Chromium CVE-2026-106264: Missing authorization

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...