EUVD-2026-63366

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

CVE-2026-28163

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...

CVE-2026-28163

The New User Approve WordPress plugin (versions ≤ 3.2.8) has a broken access control vulnerability discovered by Austin Ginder. Unauthenticated remote attackers can exploit incorrectly configured access control security levels, achieving low integrity impact (CVSS 5.3 MEDIUM). No patch version or...

EUVD-2026-63325

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...

CVE-2026-28163 WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...

OESA-2026-3417 policycoreutils security update

It contains the selinux policy core utilities Security Fixes: A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils...

WordPress Solace Extra plugin <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action vulnerability

Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Solace Extra versions = 1.6.0...

CVE-2026-14953 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

CVE-2026-14953 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

CVE-2026-14953

Frauscher Sensortechnik's FDS102 device (R2) has improper RBAC enforcement at /api/user/fetch-all.php, allowing a low-privileged remote attacker to enumerate all users and identify privileged accounts (CVSS 5.3 MEDIUM). No patch version or in-the-wild exploitation details are provided in the docu...

CVE-2026-17153 AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

EUVD-2026-62959

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...

EUVD-2026-62925

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

CVE-2026-72843: Missing Authorization

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-54509: Missing Authorization

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

JetBrains YouTrack < 2025.3.156085 / 2026.1.x < 2026.1.13914 / 2026.2.x < 2026.2.18095 Missing Authorization (CVE-2026-75044)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.156085, 2026.1.x prior to 2026.1.13914, or 2026.2.x prior to 2026.2.18095. It is, therefore, affected by a missing authorization vulnerability: - Missing authorisation allowed an authenticated user to delete arbitra...

CVE-2026-28163: Missing Authorization

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...

PT-2026-79095

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description Page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde...

PT-2026-80216

Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Summary Backpack CRUD contained an authorization issue in the way...

CVE-2026-53569: Missing Authorization

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...