CVE-2026-103907

The JNews - Jeg Elementor Kit plugin for WordPress (versions up to and including 3.2.19 ) is vulnerable to unauthorized sensitive information exposure due to a missing capability check on the jkit_post_block and jeg_find_author AJAX actions. The wp_ajax_jkit_post_block handler returns the full op...

CVE-2026-110160

A missing authorization flaw was found in the ReadingMode component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552510359...

PT-2026-113703

Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...

CVE-2026-110773: Missing Authorization

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

PT-2026-114057

🚨 CVE-2026-110615 jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account ...

PT-2026-113662

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

PT-2026-113759

Name of the Vulnerable Software and Affected Versions Kaneo versions prior to 2.1.6 Description Authenticated users can access other workspaces by providing project, task, label, or workspace identifiers to API routes that lack membership checks. This allows attackers who obtain identifiers, such...

Linux Distros Unpatched Vulnerability : CVE-2026-110772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypas...

CVE-2026-110615: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...

CVE-2026-110621: Missing Authorization

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110160

Google Chrome versions prior to 155.0.8059.79 are vulnerable to a missing authorization flaw in the ReadingMode component. A remote attacker who has already compromised the renderer process and used social engineering could leverage a crafted HTML page to potentially bypass site isolation . This ...

CVE-2026-70098

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-110211

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/namespace/slug. Attackers can locate targets through the anonymous search endpoint and trigger deletion without...

CVE-2026-110216

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110208

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

CVE-2026-110207

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin...

CVE-2026-102861

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-88198

A missing authorization vulnerability in Microsoft Office SharePoint (CVE-2026-88198) allows an authorized attacker to elevate privileges over a network. The impact is rated as High with a CVSS 3.1 score of 8.8. Microsoft has released official updates to address this issue; users are recommended ...