CVE-2026-39779: Missing Authorization

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0...

CVE-2026-62040: Missing Authorization

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1...

CVE-2026-86850: Missing Authorization

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

CVE-2026-83947

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

CVE-2026-106323

A missing authorization flaw was found in the Chrome for iOS component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553114676...

CVE-2026-84249

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

CVE-2026-107792

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-107725

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member...

CVE-2026-83947

A missing authorization vulnerability in Azure Event Grid allows an authorized attacker to perform spoofing over a network. The issue is classified under CWE-862 and carries a HIGH base severity score of 7.7. While the specific root cause and affected versions are not detailed in the provided doc...

CVE-2026-77900

A critical vulnerability in Azure App Service (CVE-2026-77900) stems from missing authentication for a critical function. This flaw allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is confirmed with a CVSS 3.1 base score of 9.8 . No specific explo...

GHSA-6P4F-J8J6-463Q Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

Indico: Missing access check in legacy session export API

Impact A legacy API to retrieve session details could be misused to retrieve metadata such as title, description and conveners of a restricted session within without having access to that session, as long as the event itself was accessible. Patches You should to update to Indico 3.3.13 as soon as...

Missing Authorization

Overview com.hazelcast:hazelcast is a clustering and highly scalable data distribution platform. Affected versions of this package are vulnerable to Missing Authorization in the MapPermission component, through the IMap Predicates API, permission checks in...

CVE-2026-107725

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member...

EUVD-2026-43181

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls...

EUVD-2026-44638

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface...

CVE-2026-107830 Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary...

CVE-2026-107830 Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary...

CVE-2026-107830

The Jivejdon software (from commit e0306088 through ee67a65e ) is vulnerable to a missing rate limiting issue on the unauthenticated /account/smsVRAction endpoint. This endpoint is handled by SmsQQAction , and the lack of restrictions allows for unlimited SMS sending. An attacker can first load n...

CVE-2026-107792 Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...