CVE-2026-75796 AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-16962: Missing Authorization

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...

PT-2026-79963

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE REQUEST HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inpu...

Kibana 8.9.x < 8.19.19 / 9.x < 9.4.5 Missing Authorization (ESA-2026-86)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.19, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-86 advisory. - The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created th...

Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-92 / ESA-2026-98 / ESA-2026-100 / ESA-2026-104 / ESA-2026-105 / ESA-2026-106 / ESA-2026-110)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-92, ESA-2026-98, ESA-2026-100, ESA-2026-104, ESA-2026-105, ESA-2026-106 and ESA-2026-110 advisories. - Missing...

CVE-2026-48751: Missing Authorization

Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu. Version 7.2.0 patches t...

PT-2026-79330

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.12.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An authorization flaw exists in the host tags listing functionality. Domain Admins are permitted to call the 'listHostTags'...

CVE-2026-50222: Missing Authorization

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...

CVE-2026-33047: Missing Authorization

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-77767: Missing Authorization

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

CVE-2026-66721: Missing Authorization

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only t...

Kibana 8.12.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-102 / ESA-2026-108)

The version of Kibana installed on the remote host is 8.12.x prior to 8.19.19, 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-102 and ESA-2026-108 advisories. - Missing Authorization CWE-862 in Kibana can lead to...

CVE-2026-75932: Missing Authorization

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...

Kibana 8.9.x < 8.19.20 / 9.x < 9.4.5 Missing Authorization (ESA-2026-95)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-95 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response...

PT-2026-79305

Name of the Vulnerable Software and Affected Versions Tamara Checkout versions prior to 1.9.9.21 Description The plugin fails to verify the order key, a nonce, or any specific capability on its public payment cancel and fail return URLs. This allows an unauthenticated attacker to change the statu...

PT-2026-79317

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Insufficient access control validation in several userdata-related APIs may allow unauthorized cross-tenant or cross-account...

CVE-2026-62940: Missing Authorization

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides including security-critical keys like security.privileged and raw.lxc are applied without any project restriction enforcemen...

Kibana 8.5.x < 8.19.20 / 9.x < 9.4.5 Missing Authorization (ESA-2026-96)

The version of Kibana installed on the remote host is 8.5.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-96 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend...

CVE-2026-49217

Mailu , a mail server distributed as Docker images, is affected by a missing authorization check in its admin REST API prior to version 2024.06.52 . When the REST API is enabled, an unauthenticated remote attacker can remove IP restrictions or modify the comment field on any existing user token v...