CVE-2026-87714

A missing authorization vulnerability in WebDAV allows an authorized attacker to bypass a security feature over a network. The vulnerability is associated with CWE-862 and has been assigned a CVSS 3.1 base score of 6.5 (MEDIUM) . The impact is primarily on integrity . No specific affected version...

CVE-2026-70085

A missing authorization vulnerability exists in the DNS Server , which allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-862 . The CVSS 3.1 score is 5.5 (Medium) , with a high impact on integrity . No specific exploit information or patch versio...

EUVD-2026-100599

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-70098

A missing authorization vulnerability in Visual Studio Code allows an unauthorized attacker to achieve remote code execution over a network. This vulnerability is classified as HIGH severity (CVSS 3.1 score of 8.8). While the technical root cause and specific affected versions are not detailed in...

CVE-2026-102233

A missing authorization vulnerability in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally . The vulnerability has a CVSS 3.1 score of 7.8 (High), with the attack vector identified as local and requiring user interaction. No specific component details, root c...

EUVD-2026-99038

Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-110230 XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

CVE-2026-110230

The software XBackBone versions through 3.8.2 is vulnerable to a missing authorization flaw in the POST /upload/{id}/vanity route. This vulnerability allows authenticated users to modify the upload share codes of other users by providing sequential upload IDs to the MediaController::createVanity(...

CVE-2026-110216

The youlai-boot software (through version 2.21.1 ) is vulnerable to a missing authorization flaw in the updateUserStatus handler. The root cause is the absence of a @PreAuthorize check, which allows any authenticated user to send PATCH requests to the /api/v1/users/{userId}/status endpoint. This ...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110215

The youlai-boot application (versions through 2.21.1 ) is vulnerable to a missing authorization flaw in the role menu assignment functionality. Specifically, authenticated users can interact with the PUT /api/v1/roles/{roleId}/menus endpoint to assign arbitrary menu and button permissions to role...

CVE-2026-110211

iFlytek SkillHub versions through 0.2.22 are vulnerable to a missing authorization flaw in the CLI Skill Delete endpoint (DELETE /api/cli/v1/skills/{namespace}/{slug} ). This vulnerability allows any authenticated user to permanently delete skills belonging to other users because the system fails...

CVE-2026-110211 SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/namespace/slug. Attackers can locate targets through the anonymous search endpoint and trigger deletion without...

CVE-2026-110211 SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/namespace/slug. Attackers can locate targets through the anonymous search endpoint and trigger deletion without...

CVE-2026-110210 Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

CVE-2026-110209 ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config...

CVE-2026-110209

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config...

CVE-2026-110209

The Stonewuu ai-fusion-video software (through version 1.2.0 ) is vulnerable to a missing authorization flaw in its configuration read endpoints. Specifically, the ApiConfigController and SystemConfigController components fail to properly restrict access, allowing authenticated non-admin users to...

CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...