EUVD-2026-95396

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

EUVD-2026-95394

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network...

EUVD-2026-95324

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

EUVD-2026-95349

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

Linux Distros Unpatched Vulnerability : CVE-2026-105399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers ca...

PT-2026-108886

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1...

PT-2026-108879

Name of the Vulnerable Software and Affected Versions Scripts n Styles versions prior to 3.5.8 Description An authorization flaw in unFocus Projects Scripts n Styles allows the exploitation of incorrectly configured access control security levels. Recommendations Update to a version newer than...

CVE-2026-87841: Missing Authorization

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state...

CVE-2026-96334: Missing Authorization

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7...

PT-2026-108773

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description Missing authorization allows a low privileged attacker with remote access to potentially elevate their privileges. Recommendations Update Dell Secure Conne...

CVE-2026-95589: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n...

Splunk Enterprise 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.2.x prior to 10.2.7 or 10.4.x prior to 10.4.3. Splunk Enterprise 9.4.x and 10.0.x are not affected. It is, therefore, affected by a missing authentication vulnerability as referenced in the SVD-2026-1001 advisory. An...

CVE-2026-76769: Missing Authorization

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

Kibana 9.2.x / 9.3.x < 9.4.0 Missing Authorization (ESA-2026-191)

The version of Kibana installed on the remote host is 9.2.0 through 9.3.8 inclusive. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-191 advisory. - Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly...

CVE-2026-86850: Missing Authorization

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

PT-2026-108889

Name of the Vulnerable Software and Affected Versions Before After Image Comparison – Image comparison for WP versions prior to 1.1.22 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Upda...

CVE-2026-96461: Missing Authorization

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

PT-2026-108858

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

Fedora 43 : cockpit (2026-9ff25022c1)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9ff25022c1 advisory. Automatic update for cockpit-368-1.fc43. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

CVE-2026-107824: Missing Authentication for Critical Function

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...