CWE-862: Missing Authorization vulnerabilities

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

The Redux Framework WordPress plugin up to version 4.5.14 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can delete arbitrary media library attachments, including those owned by administrators. This occurs because the plugin does not properly verify user authorization when a Custom Fonts field is registered on the user profile page, exposing a nonce that enables this action.

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.

The Simply Schedule Appointments WordPress plugin up to version 1.6.12.32 has a missing authorization vulnerability via the 'recursive' parameter. This allows unauthenticated attackers to access sensitive customer information including names, emails, phone numbers, and custom form data. Additionally, attackers can obtain per-appointment public_token values that enable deletion of arbitrary appointments without authentication.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

CVE-2026-47603 is a medium severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves missing authorization checks in the kernel mode driver, allowing a local user to access another process's GPU channel state. This can lead to information disclosure but does not affect integrity or availability.

NVIDIA Virtual GPU Manager contains a missing authorization vulnerability in its GPU kernel driver that allows a guest to access privileged host GPU resources without proper authorization. Exploitation could lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure. The vulnerability has a high severity score of 7.8. No affected versions or patch information are provided.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering.

CVE-2026-47559 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It exists in the kernel mode layer and allows a user to access memory belonging to another user's process. Exploitation could lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure.

CVE-2026-47552 is a high-severity vulnerability in the NVIDIA GPU Display Driver for Linux. It involves a missing authorization check in the kernel mode layer, allowing an unprivileged user to bypass security controls and modify privileged configurations. Exploitation could result in code execution, denial of service, privilege escalation, information disclosure, and data tampering.

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.