CVE-2026-82195: Missing Authorization

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a...

PT-2026-98290

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

PT-2026-97713

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against...

CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-97231: Missing Authentication for Critical Function

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public a...

PT-2026-98157

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions 0.3.1 and 0.4.0 Description A flaw exists in the Socket.IO Connect Interface component within the app.py file. Remote manipulation of an unknown function in this file allows an attacker to bypass authentication...

CVE-2026-96680

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92470

GitLab EE versions 18.7 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are vulnerable to a missing authorization check in the Duo AI troubleshooting feature . Under certain conditions, an authenticated user could access sensitive CI/CD variable values from debug-mode job traces. GitL...

CVE-2026-96680 ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

CVE-2026-96680

The ByteDance Coze Scraper Extension (up to version 2.0.2 ) contains a vulnerability in the External Message Handler component. Specifically, the chrome.runtime.onMessageExternal.addListener function within the static/background/index.js file fails to perform proper authorization when handling sp...

CVE-2026-96680 ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

CVE-2026-96603

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirmloggedin/confirmuser of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The...

CVE-2026-96603 Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirmloggedin/confirmuser of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The...

CVE-2026-96603

A vulnerability exists in the Admin Handler component of Abdurrab5 online-makeup-store . Specifically, the confirm_logged_in and confirm_user functions within the functions.php file are susceptible to missing authorization due to the manipulation of the adminid argument. This flaw can be exploite...

CVE-2026-96603 Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirmloggedin/confirmuser of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the actionGetResendModalContent process. An attacker can access sensitive submission data, including personally identifiable information, by invoking the control panel action without the required permissions...

Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...