PT-2026-107455

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27...

CVE-2026-76272: Missing Authorization

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user i...

CVE-2025-70520

The websocket handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce proper authentication restrictions against sessionless users . This vulnerability allows unauthorized individuals to view device resources , including operational logs , or perform diagnostic requests . No specific r...

CVE-2026-96335: Missing Authorization

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

PT-2026-107650

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

CVE-2026-103075: Missing Authorization

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...

CVE-2026-107205: Missing Authentication for Critical Function

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-104390: Missing Authorization

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27...

PT-2026-107454

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...

PT-2026-107672

Name of the Vulnerable Software and Affected Versions Amazon Athena engine version 3 Description Missing authorization checks in request handling could have allowed an authenticated user to read limited query metadata from other AWS accounts. The exposed information includes AWS account identifie...

PT-2026-107493

Name of the Vulnerable Software and Affected Versions smart proxy dynflow affected versions not specified Description Missing authentication exists in remote-execution task updates within the smart proxy dynflow package. When remote execution is configured in pull or pull-mqtt mode, the progress...

CVE-2026-62179: Missing Authorization

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

CVE-2026-76268: Missing Authentication for Critical Function

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer REST Application Programming Interface API on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerabili...

CVE-2026-106271

Missing authorization in Workers in Google Chrome prior to 155.0.8059...

CVE-2026-81535: Missing Authorization

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...

CVE-2026-107151: Missing Authentication for Critical Function

Missing authentication has been found in remote-execution task updates in the smartproxydynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote...

CVE-2026-93026: Missing Authorization

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-62253: Missing Authentication for Critical Function

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

CVE-2026-107206: Missing Authentication for Critical Function

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-106267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site...