PT-2026-70865

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

PT-2026-70025

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A missing authorization check allows an unauthenticated remote attacker to access scheduling-related application functions. This flaw enables the...

PT-2026-70149

Name of the Vulnerable Software and Affected Versions Swing Music version 3.0.0 Description A missing authentication issue allows unauthenticated remote attackers to create arbitrary user accounts. This occurs because the 'POST /auth/profile/create' endpoint is allowlisted from JWT JSON Web Token...

PT-2026-70116

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update resource type endpoint. The endpoint omits the administrator permission check that the corresponding delete resource type...

PT-2026-70647

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges over a network, enabling them to affect the system. Recommendations At t...

PT-2026-70940

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/library id/book id/fmt in src/calibre/srv/books.py omits needs db write=True, causing Router.dispatch to skip ctx.check for write access before update annotations passes...

PT-2026-70434

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70033

Name of the Vulnerable Software and Affected Versions SAP ABAP Development Tools affected versions not specified Description SAP ABAP Development Tools fails to perform required authorization checks for specific functionality. This allows an attacker with low privileges to execute unauthorized...

Joomla JCE 2.9.99.4 Remote Code Execution

The JCE Joomla Content Editor profile import functionality lacks proper authentication and CSRF protections. An unauthenticated attacker can upload a crafted XML file containing PHP code; the file is stored in the /tmp/ directory and can be accessed via HTTP, leading to remote code execution...

PT-2026-70065

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

PT-2026-70427

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70110

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

PT-2026-70067

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description Missing authorization checks in the upload azure, upload sftp, and upload smb VQL plugins allow an authenticated user with the analyst role to initiate outbound network connections from...

PT-2026-70387

Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

PT-2026-70367

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network...

PT-2026-70401

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Missing authorization allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a f...

PT-2026-70024

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A missing authorization check allows an unauthenticated attacker to access backend operations by sending crafted requests to the 'Cost Servlet' endpoint...

PT-2026-70368

Name of the Vulnerable Software and Affected Versions Windows RPC API affected versions not specified Description Missing authentication for a critical function in the Windows RPC API allows an authorized attacker to elevate privileges locally. Remote Procedure Call RPC is a protocol that allows ...

PT-2026-70435

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70529

Name of the Vulnerable Software and Affected Versions Windows License Manager affected versions not specified Description A missing authentication flaw in a critical function allows an authorized attacker to elevate privileges locally, potentially affecting the system. Recommendations At the...