CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

Missing Authorization

Overview geolens is an Auto-generated Python SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers. Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple API endpoints. An attacker can...

Missing Authorization

Overview geolens-cli is an Apache-2.0 command-line interface for the GeoLens API. Login, scan, publish, and export STAC against any GeoLens instance. Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple A...

Missing Authorization

Overview @geolens/sdk is an Auto-generated TypeScript SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers. Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple API endpoints. An...

CVE-2026-67262

Dell PowerStore has a Missing Authorization flaw allowing an attacker with mapped-host access to read or write LUNs beyond per-initiator access controls, enabling confidentiality, integrity, and availability impacts (CVSS 8.1 HIGH). Dell DSA-2026-330 advisory is referenced, but no affected versio...

CVE-2026-67262

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

CVE-2026-67262

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

EUVD-2026-61073

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

WordPress WP Travel Engine plugin <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'bookingid' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WP Travel Engine versions = 6.8.4...

WordPress WPAdverts – Classifieds Plugin plugin <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Deva Parekh in WordPress Plugin WPAdverts versions = 2.3.2...

ANT-2026-J5P6B5WQ · supabase/auth · other

session-flaw medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-J5P6B5WQ: Banned user obtains fresh sessions via identity linking In internal/api/identity.go,...

Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vpg-gwqq-w44c. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go...

GHSA-69JP-F2P8-9VRG Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4vpg-gwqq-w44c. This link is maintained to preserve external references. Original Description SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

WordPress Kirki plugin <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via 'context' Parameter vulnerability discovered by Datist Pham - NAB Innovation Centre Vietnam in WordPress Plugin Kirki versions = 6.1.1...

CVE-2026-75853

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75846

In ArcadeDB versions ≤ 26.7.3, DeleteFunctionStatement.executeSimple permanently removes any registered server-side function via the command API without calling checkPermissionsOnDatabase(UPDATE_SCHEMA). Any database user can delete security-relevant logic. Upgrade to 26.8.1. No in-the-wild explo...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...