CVE-2026-78069 Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

CVE-2026-78069 Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

SonicWall NSM On-Prem Affected By Multiple Vulnerabilities

1 CVE-2026-78327 - Authenticated Command Injection Vulnerability An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin...

EUVD-2026-70408

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve...

CVE-2026-85173 n8n before 2.36.2 Missing Authorization via Insights API

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve...

CVE-2026-85173 n8n before 2.36.2 Missing Authorization via Insights API

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve...

CVE-2026-85173 n8n before 2.36.2 Missing Authorization via Insights API

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve...

CVE-2026-85173

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes . Authenticated users holding insights scopes can supply arbitrary projectId parameters to retrieve workflow names and execution statistics from projects they are not members of, effect...

BIT-ELASTICSEARCH-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

Exploit for Missing Authorization in Vmware Spring_Boot

No d...

Missing Authorization in Elasticsearch Leading to Information Disclosure

...

terrapod-PoC

Terrapod: security advisory CVE status: requested, pend...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via cancellation of downstream builds in Pipeline: Build Step Plugin. An attacker can cancel downstream Jenkins builds without the required Item/Cancel permission because the plugin fails to verify that the build's...

EUVD-2026-70303

Cheshire Cat AI's GET /memory/collections/collectionid/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...

CVE-2026-85433: Missing Authorization

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARECMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARECMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary address...

CVE-2026-70178: Missing Authorization

Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

CVE-2026-85390: Missing Authorization

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...

CVE-2026-85309: Missing Authorization

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...

CVE-2026-84238: Missing Authorization

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

CVE-2026-85213: Missing Authorization

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server b...