PT-2026-104558

Dell Container Storage Modules, versions prior to 1.18.0 contains an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information tampering...

EUVD-2026-76105

Headroom vulnerable to Cross-Site WebSocket Hijacking CSWSH...

GHSA-4VPG-GWQQ-W44C SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Same CWE-862 family, found via an automated bulk sweep of every /api/block/ handler in kernel/api/block.go for the presence of any access-check reference IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess anywhere in the function body. 17 of 28 candidate endpoints have none...

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Same CWE-862 family, found via an automated bulk sweep of every /api/block/ handler in kernel/api/block.go for the presence of any access-check reference IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess anywhere in the function body. 17 of 28 candidate endpoints have none...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046

Kentico Xperience 13 versions prior to 13.0.216 are vulnerable to an object-level authorization deficiency. The issue stems from a lack of proper authorization checks for administration API endpoints , which may allow unauthorized access to administrative functions. Specific details regarding the...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-105046

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-95102 Monta monta.app Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

CVE-2026-95102 Monta monta.app Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

CVE-2026-82041

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-104991

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

EUVD-2026-91796

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-82041

UTMStack versions before 11.2.16 are vulnerable to a missing authorization flaw in the UTMIncidentCommandWebsocket.processCommand() function. Specifically, the handler mapped to the /command/{hostname} STOMP destination fails to perform role checks or apply a command allowlist. This allows any au...

CVE-2026-82041 UTMStack < 11.2.16 Missing Authorization via Command WebSocket

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...