2725 matches found
CVE-2026-7514 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper...
CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...
CVE-2026-56827
Shopper , a headless e-commerce admin panel, contains an authorization bypass in five Filament groupedBulkActions blocks (Attribute, Tag, Brand, Category, Supplier pages) that omit the ->authorize() permission gate while page access requires only read-only browse_* permissions. A browse-only s...
EUVD-2026-78281
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...
CVE-2026-16592 WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...
PT-2026-91048
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden...
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...
GO-2026-6430 SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel
SiYuan: Database view structure all view names, layout types and per-field visibility is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel...
CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update
Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...
CVE-2026-86750
Snipe-IT versions ≤ 8.6.3 (fixed in 8.7.0 ) contain an authorization bypass in the REST API's Api\UsersController::store() and ::update() methods. User records are persisted before the requested company identifiers are validated against the actor's permitted companies via Company::getIdsForCurren...
EUVD-2026-74716
The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...
SUSE CVE-2026-25712
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...
CVE-2026-86750: Incorrect Authorization
Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...
CVE-2026-33391
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...
EUVD-2026-72788
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...
CVE-2026-33391 Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...
CISA: Logging Reference Architecture Updated
The Cybersecurity and Infrastructure Security Agency CISA developed the Logging Reference Architecture LRA in alignment with Office of Management and Budget Memorandum M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, which w...
PT-2026-87078
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart...
ROS-20260908-73-0038
The vulnerability in Golang-X-Net is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...