PT-2026-98256

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description A missing authorization issue exists in the ServiceNow AI Platform. This flaw could allow an unauthenticated user to extract instance data beyond the intended scope, potentiall...

PT-2026-97713

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against...

CVE-2026-3253: Missing Authorization

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

PT-2026-98290

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-63203: Missing Authorization

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

PT-2026-98245

Name of the Vulnerable Software and Affected Versions Dell ThinOS 10 versions prior to SecurityAddon 2605.10.2766 T10 Description An issue exists where authentication is missing for a critical function. This allows an unauthenticated attacker with remote access to potentially gain unauthorized...

CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

PT-2026-98226

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0 Description The get trip summary function in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring the trips:read scope. This allows a token granted only unrelated capabilities,...

CVE-2026-4806: Missing Authorization

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the saveoption function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or...

CVE-2026-88956: Missing Authentication for Critical Function

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

PT-2026-97777

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3 Description A missing authorization issue exists in the Task Group APIs. The affected APIs fail to properly verify if an authenticated user possesses the necessary permissions to access the proje...

CVE-2026-97231: Missing Authentication for Critical Function

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public a...

PT-2026-98157

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions 0.3.1 and 0.4.0 Description A flaw exists in the Socket.IO Connect Interface component within the app.py file. Remote manipulation of an unknown function in this file allows an attacker to bypass authentication...

FreeBSD : Gitlab -- vulnerabilities (3f11e437-b7cd-11f1-a883-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3f11e437-b7cd-11f1-a883-2cf05da270f3 advisory. Gitlab reports: Double Free issue in Regular Expression Parser impacts GitLab CE/EE Integer...

CVE-2026-96680

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92470

GitLab EE versions 18.7 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are vulnerable to a missing authorization check in the Duo AI troubleshooting feature . Under certain conditions, an authenticated user could access sensitive CI/CD variable values from debug-mode job traces. GitL...

CVE-2026-96680 ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...