37307 matches found
PT-2026-88541
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Downloads component allows a remote attacker to bypass system access restrictions by using a crafted Chrome extension. Recommendations Update Google Chrome ...
PT-2026-87063
Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.13 Description A missing authorization issue exists in the force-agreement controller. This allows any ACP administrator to access and submit force-agreement forms, bypassing the assigned permissions and the optio...
PT-2026-86997
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...
PT-2026-87122
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...
PT-2026-87682
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
PT-2026-88703
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to...
CVE-2026-83942: Missing Authorization
Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...
CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...
CVE-2026-86438
Lara Dashboard versions prior to 1.3.2 contain an authorization bypass in the MarketplaceModuleBrowser Livewire component. The installModule action fails to restrict access to Superadmin-level roles, allowing any authenticated non-Superadmin administrator to trigger module installation. Because m...
CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436
Lara Dashboard before version 1.3.2 fails to enforce authorization on the post-builder image and video upload endpoints , permitting authenticated accounts without content permissions to upload files. Attackers can exploit this by uploading polyglot files with attacker-chosen extensions into the ...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86479
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR...
CVE-2026-86479
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR...
CVE-2026-86479
JetBrains YouTrack versions prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 are affected by a missing authorisation vulnerability that allows unauthorised access to restricted REST API resources via an IDOR (Insecure Direct Object Reference) flaw. An attacker with low-level privileges (e.g...
CVE-2026-61410
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerabili...
EUVD-2026-72396
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...