CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-61745 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-61745 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

EUVD-2026-84039

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-61745 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-83621

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

UBUNTU-CVE-2026-83621

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

SUSE CVE-2026-72812

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

CVE-2026-84990 ntopng: Missing Authorization on System Configuration Backup Download and Listing

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-84990 ntopng: Missing Authorization on System Configuration Backup Download and Listing

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-84990 ntopng: Missing Authorization on System Configuration Backup Download and Listing

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-63342

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, is affected by a cross-tenant authorization bypass prior to version 0.91.1 . The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (implemented by listDurableEventLog) fails to require the target ten...

CVE-2026-75158 Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID,...

CVE-2026-94213

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

CVE-2026-94213 Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

CVE-2026-94215: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...