CVE-2026-107914

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export...

EUVD-2026-95396

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

EUVD-2026-95394

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network...

EUVD-2026-95324

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function...

EUVD-2026-95349

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-108112: Missing Authorization

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CVE-2026-108111: Missing Authorization

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

CVE-2026-87846: Missing Authorization

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

CVE-2026-96334: Missing Authorization

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7...

CVE-2026-95597: Missing Authorization

Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17...

CVE-2026-88931: Missing Authorization

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-86850: Missing Authorization

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

WordPress Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More plugin <= 1.16.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Paul Serban in WordPress Plugin Envira Photo Gallery versions = 1.16.1...

PT-2026-108800

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism...

PT-2026-108879

Name of the Vulnerable Software and Affected Versions Scripts n Styles versions prior to 3.5.8 Description An authorization flaw in unFocus Projects Scripts n Styles allows the exploitation of incorrectly configured access control security levels. Recommendations Update to a version newer than...

PT-2026-108959

Name of the Vulnerable Software and Affected Versions ruoyi-ai versions 3.0.0 through 3.1.0 Description An authorization flaw exists in the 'GET /workflow/search' endpoint. Authenticated users without administrative privileges can query this endpoint to list enabled private workflows within the...

PT-2026-108960

Name of the Vulnerable Software and Affected Versions ruoyi-ai versions 3.0.0 through 3.1.0 Description An authorization flaw allows authenticated users to delete workflows belonging to other users. An attacker can retrieve workflow UUIDs through the 'GET /workflow/search' endpoint and then use...

PT-2026-109215

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-107824: Missing Authentication for Critical Function

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-107813: Missing Authorization

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...