CVE-2026-85669: Missing Authorization

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-78596

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

CVE-2026-82302

CVE-2026-82302 is an Incorrect Authorization (CWE-863) vulnerability in Kibana that allows an attacker with low privileges to modify configurations without proper authorization, via exploiting incorrectly configured access control security levels (CAPEC-180). The CVSS 3.1 score is 8.1 (HIGH) , wi...

CVE-2026-78596: Missing Authorization

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

CVE-2026-77125

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

CVE-2026-77125 Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

CVE-2026-77784 Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-84653: Missing Authorization

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

CVE-2026-77125: Incorrect Authorization

A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing...

CVE-2026-78609: Incorrect Authorization

Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in t...

Incorrect permission check in Appearance configuration page

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page added in Jenkins 2.421. This allows attackers with Overall/Manage permission to modify Appearance configuration options they...

CVE-2026-73779 Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could compromise system integrity and further expose sensitive information...

CVE-2026-73779 Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could compromise system integrity and further expose sensitive information...

CVE-2026-73779

CVE-2026-73779 affects the AOS-CX switch operating system (HPE), where a set of vulnerabilities allows an unauthenticated remote actor on an adjacent network to circumvent existing authentication controls . Successful exploitation can lead to information disclosure , unauthorized modification , a...

CVE-2026-73764 Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of...

CVE-2026-73764

CVE-2026-73764 affects the operating system of HPE AOS-CX switches , where an unauthenticated actor from an adjacent network can bypass authentication controls, enabling unauthorized modification of resources and limited service disruption . The CVSS 3.1 score is 7.1 (HIGH) with an attack vector ...

CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

CVE-2026-72641 Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)

Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read...

PT-2026-84482

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description Issues in the operating system of AOS-CX switches may allow an unauthenticated remote actor to bypass authentication controls. This could lead to the unauthorized modification of...