Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.
CVE-2026-93332 is a medium severity vulnerability in Devolutions Server versions prior to 2026.3.7.0. It involves improper access control in the partial connection API, allowing an authenticated low-privileged user to read, create, modify, and delete System Vault entries. This vulnerability does not require user interaction and has a network attack vector.
Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.
This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.
Apache Karaf versions before 4.4.12 have a vulnerability in the JMX MBeanServer access control. The KarafMBeanServerGuard enforces role-based access control (RBAC) on certain MBean operations but omits lifecycle operations like createMBean, registerMBean, and unregisterMBean from checks. This allows any authenticated JMX user, including those with minimal 'viewer' roles, to instantiate and remove arbitrary MBeans without authorization. Exploiting this, an attacker can instantiate the standard JDK MLet MBean to load and execute attacker-controlled classes remotely, leading to remote code execution. The issue is fixed by adding these lifecycle operations to the guarded list and restricting them to the 'admin' role in Apache Karaf 4.4.12 and later.
Apache Karaf versions before 4.4.12 have a security vulnerability where the shell/SSH command ACL enforcement fails open for unmatched commands, allowing any authenticated user to execute certain commands like config:install. This command can fetch and overwrite critical configuration files, potentially leading to privilege escalation. The default configuration does not enforce strict role checks for unmatched commands, increasing risk. Mitigation involves explicitly restricting the install command to admin roles or enabling a setting to fail unmatched commands closed.
CVE-2026-91048 is a critical privilege escalation vulnerability in Apache Karaf affecting versions prior to 4.4.12. The jdbc and jms shell commands lack proper ACL configuration, allowing any authenticated user, including those with only viewer role, to execute all jdbc:* and jms:* commands. This flaw enables an attacker to store a fully controlled JDBC URL that can trigger arbitrary code execution via JDBC driver URL parameters, bypassing admin role restrictions.
CVE-2026-49994 is a critical vulnerability in dannymcc bluehood prior to version 0.7.1. When authentication is enabled, only HTML page handlers enforced session validation, while API endpoints under /api/* did not check authentication. This allowed a network attacker with access to the dashboard port to read Bluetooth tracking data and modify application state without a session cookie. The issue is fixed in version 0.7.1.
WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write(text,text,bool), pg_file_rename(text,text,text), pg_file_unlink(text), and pg_logdir_ls(). These functions are executable by any authenticated database role with no GRANT required, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived implementations as part of Greenplum's merge to a PostgreSQL 12 base. A non-superuser can use pg_file_write, pg_file_rename, and pg_file_unlink to create, overwrite (append), rename, and delete files under the data and log directories, and can use pg_logdir_ls() to enumerate log file names. Because postgresql.auto.conf resides in the data directory, a non-superuser can append configuration directives such as shared_preload_libraries or archive_command to it, resulting in arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected, as the equivalent functions there enforce a superuser check internally.
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.
Apache Roller 6.1.5 contains a missing authorization vulnerability in its legacy XML-RPC Blogger and MetaWeblog APIs. Authenticated users can read, modify, or delete content from other weblogs because the API handlers authenticate the caller but do not verify permissions on the affected weblog or entry. This issue affects installations with the non-default global XML-RPC setting enabled. The vulnerability is fixed in Apache Roller 6.1.6 by adding explicit per-method permission checks. Users are advised to upgrade or disable the XML-RPC feature to mitigate the risk.
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.
CVE-2026-97227 is a vulnerability in the NextScripts: Social Networks Auto-Poster WordPress plugin versions before 4.4.8. The plugin fails to perform proper capability or ownership checks on several AJAX actions, relying solely on a nonce for authorization. This flaw allows users with posting feature access granted by an administrator to export social account credentials, delete arbitrary posts, and reset the plugin's configuration.
CVE-2026-96897 is a vulnerability in the Optima Express IDX WordPress plugin versions 8.5.0 up to but not including 8.7.6. The plugin fails to perform authorization checks on a specific AJAX action accessible to unauthenticated users. This flaw allows attackers to create an author-role account with a fixed username and repeatedly rotate its application password on any affected installation.
CVE-2026-96896 is a high-severity vulnerability in the Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin versions before 19.9.7. The plugin fails to perform an authorization check on one of its AJAX actions, allowing users with subsite administrator roles on a multisite network to write and delete arbitrary files in the shared filesystem. This can lead to remote code execution.
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.
The Testimonials Widget WordPress plugin up to version 4.0.4 has a missing authorization vulnerability. This flaw allows unauthenticated users to submit or modify testimonials via the front-end form without proper capability or ownership checks. Attackers can create or overwrite posts, including changing titles, content, and authorship.
CVE-2026-96525 is a vulnerability in the MCP Server for WordPress plugin before version 1.8.2. It allows users with the Contributor role to create, update, and delete site-wide workflow configurations via REST routes without proper ownership or capability checks. This includes workflows created by administrators, potentially leading to unauthorized modification of workflow settings.