100569 matches found
CVE-2026-53569: Missing Authorization
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...
PT-2026-80779
Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Summary Backpack CRUD contained an authorization issue in the way...
PT-2026-79013
ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...
PT-2026-78998
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...
CVE-2026-49217: Missing Authentication for Critical Function
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...
Photon OS 5.0: Gawk PHSA-2026-5.0-91-0966
An update of the gawk package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0966. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Gawk PHSA-2026-5.0-92-0966
An update of the gawk package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0966. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
JetBrains YouTrack < 2026.2.18112 Information Disclosure (CVE-2026-75046)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18112. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could enumerate accounts via the users search endpoint. CVE-2026-75046 Note that Nessus has not tested for this...
CVE-2026-64965: Missing Authorization
ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...
Missing Authentication for Critical Function
Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...
CVE-2025-52182: Missing Authentication for Critical Function
The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...
CVE-2026-76878
In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...
CVE-2026-76394
In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...
CVE-2026-76360
In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...
CVE-2026-76394 Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit
In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...
CVE-2026-76394 Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit
In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...
CVE-2026-76394
Splunk AI Toolkit versions below 6.0.0 have multiple REST API handlers that fail to enforce authorization checks, allowing low-privileged users (without admin or power roles) to start/stop/configure containers and read/modify connection and configuration data. CVSS 8.3 HIGH; remediation is to upg...
CVE-2026-76368 Missing Authorization through Playbooks in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before...
CVE-2026-76368 Missing Authorization through Playbooks in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before...