Arcane versions prior to 2.11.0 contain an incorrect authorization vulnerability in the AuthMiddleware.managerAuth component. This flaw allows an attacker possessing a valid X-Arcane-Agent-Token to access administrator-restricted Go pprof runtime and diagnostic endpoints without proper admin checks. The vulnerability is fixed in version 2.11.0.
CVE-2026-61726 is a high-severity improper access control vulnerability in Tandoor Recipes prior to version 2.6.12. It allows authenticated users with read and write API scope within a shared Space to read and modify private recipe steps belonging to other members of the same Space. The flaw arises because the application checks only Space membership rather than recipe-level ownership or sharing permissions when accessing certain API endpoints. This issue does not allow cross-Space access and is fixed in version 2.6.12.
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.
To remediate this issue, users should upgrade to version V11.3.2 or later.
A vulnerability in MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 allows a low-privileged attacker to change another account's password due to improper handling of an empty password in the GRANT PROXY statement. This flaw is fixed in the specified versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-86009 is an improper authorization vulnerability in Mailu mail server prior to commit f05aeb8322e2f61096af6b089d61ba6f40587d96. It allows domain managers to enable spoofing for domains they do not control, enabling them to send emails authenticated with DKIM/SPF for unauthorized domains. This flaw is fixed in the specified commit.
CVE-2026-110806 is an incorrect authorization vulnerability in Devolutions Server versions 2026.3.8.0 and earlier. It allows an authenticated user with only View permission to access unredacted add-on passwords through add-on properties returned in connection data. This vulnerability does not require user interaction and has a medium severity rating with a CVSS score of 6.5.
CVE-2026-110287 is an improper access control vulnerability in Devolutions Server versions prior to 2026.3.10. It allows an authenticated user who has general Edit permissions but lacks Edit asset permission to modify the asset contact password by sending a crafted request to the partial-save endpoint. The vulnerability has a CVSS score of 4.3, indicating medium severity.
NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, allowing them to stop any unprotected Windows service and change its startup type. This leads to denial of service of critical system services. Services protected by Windows (PPL processes, Windows Tamper Protection), such as Windows Defender, cannot be stopped or reconfigured.
This issue was fixed in version 8.12
CVE-2026-18256 is an authorization vulnerability in Mattermost that affects certain 11.x versions. It allows authenticated users without proper permissions to see private teams in public team search results, exposing private team IDs, names, and display names. The issue arises from improper restriction of private teams in search functionality.
Mattermost versions 11.7.0, 11.8.0, 11.9.0, and 11.10.0 contain an authorization flaw where the invited recipient's email address is not properly validated when redeeming team and guest invitation tokens. This allows an authenticated attacker to join a team or access private channels by using a forwarded or leaked invitation link.
CVE-2026-19076 is an incorrect authorization vulnerability in Mattermost affecting certain 11.x versions. It allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by exploiting the account type switch endpoint. The attacker can set a password and detach the account from its identity provider via a crafted POST request to /api/v4/users/login/switch. This vulnerability impacts Mattermost versions 11.10.0, 11.7.0, 11.9.0, and 11.8.0.
Mattermost versions 11.7.0 through 11.7.9, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 contain an authorization flaw. This flaw allows an authenticated attacker with guest privileges to escalate their role to team or channel admin by exploiting improper validation of combined guest and admin scheme roles via a crafted PUT request to the member roles API endpoint.
The WSP MCP AI Agents Connector plugin for WordPress versions up to 2.9.5 has an authorization vulnerability that allows authenticated users with Subscriber-level access or higher to access sensitive information. Specifically, these users can retrieve titles, URLs, authors, categories, tags, and excerpts of all unpublished posts, including drafts, pending, and scheduled posts. This occurs because the plugin's endpoint accepts any logged-in user and does not restrict access based on post ownership or author.
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
CVE-2026-111235 is a critical authorization bypass vulnerability in the REST API of multiple versions of OpenNMS Meridian and Horizon. The issue arises from case-sensitive HTTP method checks in Spring Security filter chains, allowing requests with non-canonical (e.g., lowercase) HTTP methods to bypass authentication. This enables remote unauthenticated attackers to read monitored inventory and create, modify, or delete resources, including injecting events to manipulate alarms. The vulnerability is fixed by adding terminal deny rules to REST filter chains. Upgrading to Meridian 2024.3.14, 2025.0.11, 2026.0.1 or Horizon 36.0.5 or newer resolves the issue. These products are intended for private network use and should not be exposed directly to the Internet.
CVE-2026-55103 is a vulnerability in the discourse-activity-pub plugin for Discourse that allows remote attackers to edit, delete, or reply to federated posts without proper permissions due to insufficient verification of the actor's identity and ownership. This flaw existed prior to a specific commit that fixed the issue by ensuring the actor authenticated by the signed request matches the Activity actor and owns the referenced post.
CVE-2026-71490 is an incorrect authorization vulnerability in OPNsense core versions prior to 26.1.11. It stems from improper handling of directly assigned comma-separated privilege values in the hasPrivilege() function, allowing users with both write and user-config-readonly privileges to bypass read-only restrictions. This enables unauthorized configuration changes via MVC APIs protected by throwReadOnly(). The vulnerability does not affect group privileges due to different parsing logic. The issue is fixed in version 26.1.11.
CVE-2026-110724 is a vulnerability in Eclipse Connected Services Platform's api-gateway component up to version 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.
CVE-2026-18659 is a medium severity vulnerability in Eclipse Jetty affecting multiple versions of jetty-security, jetty-eeN-security, and jetty-eeN-servlet. The issue involves bypassing Jakarta Spec constraints defined as http-method-omission by using substrings of the defined HTTP methods.