CVE-2026-109203: Missing Authorization

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its version...

CVE-2026-109202: Missing Authorization

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since...

CVE-2026-109201: Missing Authorization

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP...

CVE-2026-109188: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

CVE-2026-109185: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebin...

CVE-2026-109178: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP...

CVE-2026-109173: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting...

CVE-2026-109171: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...

CVE-2026-109179: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions...

CVE-2026-107869: Missing Authorization

Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4...

CVE-2026-107423: Missing Authorization

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22...

CVE-2026-103356: Missing Authorization

Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15...

CVE-2026-107791: Missing Authorization

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

CVE-2026-57118: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /path/list, POST /path, and POST /path/agentid' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let...

Fedora 44 : python3.13 (2026-67c5f750b3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-67c5f750b3 advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Rocky Linux 9.6 [CIQ] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ciqsa-2026_1635)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261635 advisory. This advisory aggregates security fixes for the openssl SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2024-12797. Tenable has extracted the preceding description...

PT-2026-110926

Name of the Vulnerable Software and Affected Versions ERPNext versions 9.0.0 through 16.50.0 Description Authenticated users, including those with access to the customer portal, can view stock quantities for every item batch across warehouses. This is possible due to missing authorization in...

PT-2026-110587

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions prior to 9.4 Description Authenticated users can access and modify unauthorized documents due to missing authorization in SoapDocumentService operations. By using sequential document IDs via SOAP or the...

PT-2026-110740

Name of the Vulnerable Software and Affected Versions Grav Star Ratings versions 2.0.1 through 2.0.3 Description Missing authorization allows unauthenticated visitors to cast votes by bypassing client-side vote access and readonly enforcement. An attacker can utilize the anonymous nonce provided ...

CVE-2026-108475: Missing Authorization

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6...