CVE-2026-85209

The Learning Management System (LMS) developed by AVEZ Electronics Communication Training and Consultancy Trade Inc. is impacted by a Missing Authorization vulnerability (CWE-862). The root cause is incorrectly configured access control security levels , which allows for exploitation. The vulnera...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104472

YesWiki versions prior to 4.6.7 are affected by a missing authorization vulnerability in the attachment download handler . This flaw allows unauthenticated attackers to bypass page read Access Control Lists (ACLs). By requesting the download handler with a known page tag and file parameter , an a...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

EUVD-2026-91461

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

CVE-2026-104450

YesWiki versions before 4.6.7 are vulnerable to a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php ). This flaw allows unauthenticated attackers to bypass write Access Control List (ACL) checks by sending POST requests with pagetag, title, and description f...

EUVD-2026-91448

YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclos...

CVE-2026-104438

YesWiki versions before 4.6.7 are susceptible to a missing authorization vulnerability within the listpagestag and includepages actions of the tags tool. The root cause is the failure to apply read-ACL filtering , which allows unauthenticated or unprivileged attackers to enumerate pages. By embed...

CVE-2026-103762 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any...

CVE-2026-103762 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any...

CVE-2026-103762

SiYuan versions prior to v3.8.5 are susceptible to a missing authorization vulnerability within the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints. Attackers with read-only or anonymous publish access can exploit this by performing a POST request with any open note...

EUVD-2026-91419

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any...

CVE-2026-103762 SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any...

Exploit for CVE-2026-94541

CVE-2026-94541 — WPMobile.App Table of Contents - Execut...

CVE-2026-80337

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

EUVD-2026-91324

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80337 Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80337 Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80337

The HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is susceptible to a Missing Authorization vulnerability (CWE-862 ). This flaw allows attackers to access functionality that is not properly constrained by Access Control Lists (ACLs) , specifically enabling unauthorized Cross-Chat...

CVE-2026-85004 Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option...