CVE-2026-14549

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin (versions up to 1.7.3) exposes an AJAX action that does not perform capability or nonce checks. This allows any authenticated user, including Subscribers, to add or delete the site’s configured languages. Affected component: WordPress plugin Ray Ent...

CVE-2026-18348

Velociraptor CVE-2026-18348 involves missing authorization checks in the upload_azure, upload_sftp, and upload_smb VQL plugins. An authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL boundary. This c...

CVE-2026-44764

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...

CVE-2026-44765

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve,...

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

CVE-2026-66764

CVE-2026-66764 affects SAP S/4HANA, specifically the Reprocess Bank Statement Items functionality. The root cause is missing authorization checks for authenticated users, enabling them to use rules not shared with them. This results in privilege escalation with a low impact on confidentiality (C:...

CVE-2026-58244

Technical details (affected components, root cause, exploitability, and remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-58243

The CVE-2026-58243 entry concerns SAP ABAP Development Tools failing to perform necessary authorization checks for certain functionality, enabling a low-privilege attacker to perform unauthorized database operations on SAP NetWeaver AS ABAP. The issue can lead to reading and modifying sensitive d...

CVE-2026-58243 Privilege Escalation vulnerability in SAP ABAP Developer Tools

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-58241

Technical details about CVE-2026-58241 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-55865

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve,...

CVE-2026-44765

SAP Manufacturing Integration and Intelligence (MII) contains a Missing Authorization Check allowing unauthenticated remote access to scheduling-related functions. Impact is reported as low for confidentiality, integrity, and availability. CVSS 3.1 base score 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/...

EUVD-2026-55864

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...

CVE-2026-44764

CVE-2026-44764 concerns SAP Manufacturing Integration and Intelligence (MII) where a missing authorization check in the Cost Servlet could allow an unauthenticated attacker to send crafted requests with specific parameters, potentially enabling read, create, modify, or delete operations on applic...

PT-2026-70437

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70111

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...

PT-2026-70117

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job metrics handlers accept no authorization extractor, bypassing workspace-level...

PT-2026-70841

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get users, /user/get all users uid, and /group/get groups. Attackers can explo...

PT-2026-70865

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...