CVE-2026-82377: Missing Authorization

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-100879

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-100879 zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-100879 zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-100879

A security flaw exists in zhistaredu StarTraining up to version 3.8.1 . The vulnerability is located in the checkRoleAllowed function within the SysRoleServiceImpl.java file of the dataScope Endpoint component. This flaw leads to missing authorization , which may be triggered via a remote attack ...

EUVD-2026-88034

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/station/stationid/file/id/play endpoint. An attacker can access and download media files from stations they do not have permission to view by enumerating sequential IDs and exfiltrating the complet...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the download endpoint. An attacker can access restricted audio content by directly requesting media files using valid media identifiers. Remediation Upgrade azuracast/azuracast to version 0.23.8 or higher...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Liquidsoap API endpoint due to missing internal connection requirements and improper validation of the AutoDJ flag. An attacker can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclo...

CVE-2026-100744

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

EUVD-2026-87817

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744

A flaw in coollabsio Coolify versions up to 4.1.2 within the Route-Level Middleware component leads to a missing authorization vulnerability. The issue resides in an unknown function within the app/Http/Middleware/CanUpdateResource.php file. This flaw can be triggered via a remote manipulation at...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100879: Missing Authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-101063: Missing Authorization

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-100853: Missing Authorization

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100744: Missing Authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

PT-2026-99504

Name of the Vulnerable Software and Affected Versions Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin versions prior to 19.9.7 Description An authorization check is missing in an AJAX action, which allows users with a subsite administrator role on a multisite network to write a...