The Post Duplicator plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.0.11. The flaw allows authenticated users with Contributor-level access or higher to duplicate posts with future or private status, bypassing editorial review. The REST endpoint also ignores administrator-configured restrictions on which post types can be duplicated.
Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.
CVE-2026-62941 is a critical authorization vulnerability in incus, a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check occurs before the source instance's configuration is merged. This allows dangerous configuration keys to bypass project restrictions. The issue is patched in version 7.3.0.
CVE-2026-62313 is an authorization vulnerability in Incus, a system container and virtual machine manager. Prior to version 7.3.0, the project-level enforcement of the 'restricted.containers.privilege=isolated' setting can be bypassed. This allows users to create containers that share the host's uid/gid map, defeating the intended isolation between containers and weakening security boundaries. The issue arises because the enforcement only rejects an explicitly set 'security.idmap.isolated=false' but does not enforce restrictions when the key is omitted, which defaults to non-isolation. Version 7.3.0 includes a patch for this vulnerability.
CVE-2026-17559 is a medium severity vulnerability in the Passster WordPress plugin versions 4.3.3 up to but not including 4.3.9. The plugin incorrectly authorizes REST API requests by matching endpoint paths as unanchored substrings rather than resolved routes. This flaw allows unauthenticated attackers to bypass global password protection and read protected post and page content.
A vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.14 allows vendors to manipulate their reverse-withdrawal payment records. The plugin does not validate the payment amount supplied by the client against the vendor's actual outstanding balance, enabling vendors to credit arbitrary amounts and clear commission debts without payment.
CVE-2026-69555 is a critical vulnerability in Microsoft Azure ARC involving incorrect authorization that allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a CVSS score of 10.0, indicating high impact on confidentiality and integrity. Microsoft has issued an official fix and manages remediation for this cloud service.
CVE-2026-54136 is an authorization vulnerability in windmill-labs windmill prior to version 1.715.0. A resource-scoped API token could access script contents outside its allowed path scope via the GET /api/w/{workspace}/scripts/list_search endpoint. The flaw was due to insufficient enforcement of resource/path scope in the route-level middleware and lack of per-row filtering in the handler. Exploitation requires a valid scoped API token but not administrator privileges. The issue is fixed in version 1.715.0.
CVE-2026-7485 is an incorrect authorization vulnerability in Checkmk versions prior to certain patch levels. It affects frozen BI aggregations and allows an authenticated user with restricted host and service visibility to discover the names and existence of hosts and services they should not be authorized to see. The vulnerability has a low severity score and does not allow further privilege escalation or data modification.
CVE-2026-14949 is an authorization vulnerability in Frauscher Sensortechnik FDS 102 that allows a low privileged remote attacker with a valid session to create new user accounts with arbitrary roles, including the highest privilege level. This flaw exists in the user creation functionality exposed via /api/user/add.php. The vulnerability affects versions from 2.11.0 up to and including 2.13.3. The CVSS 4.0 base score is 8.5, indicating high severity.
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
CVE-2026-54742 is an authorization vulnerability in LemmyNet's lemmy software affecting versions prior to 0.19.19 and certain 1.0.0-alpha releases. It allows a community moderator to feature or unfeature posts in communities they do not moderate by exploiting insufficient verification of post ownership during federated CollectionAdd and CollectionRemove activities. This can lead to unauthorized modification of featured content across communities. The issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
CVE-2026-68561 is a high-severity privilege management vulnerability in Wekan versions prior to 9.89. It allows any board member, including those with read-only or comment-only permissions, to escalate privileges by modifying multiple board fields in a single update. This flaw enables an attacker to make themselves the sole board administrator, expose private boards, and remove legitimate owners. The issue is fixed in version 9.89 by restricting modifications to the 'sort' field alone and preventing removal of the last active administrator.
IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 contain an incorrect authorization vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can disrupt the host processor state, impacting confidentiality and availability of the managed system and all hosted partitions.
Akaunting version 3.1.21 contains an authenticated improper authorization vulnerability in its BulkActions dispatcher component. This flaw allows users with some level of access to perform actions they are not authorized to execute. The vulnerability is identified as CWE-863 and has a high severity rating with a CVSS 4.0 score of 8.7.
IBM Power Systems Firmware versions including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 through OP940.81 (Power HMC) contain an authorization vulnerability. This flaw exists in the interface between the Baseboard Management Controller (BMC)/Flexible Service Processor (FSP) and the host system. An attacker with service account or root access to the BMC/FSP can exploit this to write arbitrary data to hardware control registers, gaining full control over the host system and all hosted partitions. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. The CVSS v3.1 score is 8.1, indicating high severity. No patch or remediation information is provided in the available data.
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licenses, /users/bulkeditsave can modify out-of-scope profiles, and /users/merge can soft-delete users and transfer assigned assets. This issue is fixed in version 8.6.3.
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.