HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.
CVE-2026-85878 is a critical improper authorization vulnerability in Microsoft Azure HorizonDB (Azure Database for PostgreSQL). It allows an authorized attacker to elevate privileges over a network, potentially leading to full compromise of confidentiality, integrity, and availability of the database service. The vulnerability has a CVSS score of 9.9, indicating a severe impact. Microsoft has issued an official fix for this cloud service vulnerability.
CVE-2026-70200 is a critical path traversal vulnerability in Microsoft Azure Logic Apps that allows unauthorized attackers to elevate privileges over a network. The flaw involves improper limitation of a pathname to a restricted directory, enabling attackers to access unauthorized resources. This vulnerability has a CVSS score of 10.0, indicating its critical severity. Microsoft has issued an official fix for this vulnerability. As Azure Logic Apps is a cloud service, Microsoft manages the remediation on their side.
WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpoint_websocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated and forwards every TrafficDelta event without per-user authorization in handleWebsocket(). A low-privilege user can enumerate peer public keys through EntityId and monitor BytesReceived and BytesTransmitted values for peers belonging to other users. The same connection exposes interface_stats and interface names that the REST API limits to administrators. Tunnel content, AllowedIPs, and user identities remain authorization-gated. This issue is fixed in version 2.3.0.
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.
CVE-2026-49446 is an improper authorization vulnerability in azukaar Cosmos-Server versions prior to 0.22.19. The flaw allows an attacker with a valid API key for an enrolled device to bypass authentication and authorization checks by manipulating forward-auth headers through the Constellation Nebula tunnel. This enables user impersonation and unauthorized admin-level access to proxied applications. The issue is fixed in version 0.22.19.
OpenAM versions prior to 16.1.1 have an improper authorization vulnerability in the AuthorizationCodeGrantTypeHandler related to PKCE enforcement. When the realm-wide codeVerifierEnforced setting is disabled (the default), an attacker who intercepts a PKCE-protected authorization code can redeem it without providing the required code_verifier, bypassing intended security controls. This affects public clients directly, while confidential clients require additional authentication material for exploitation. The issue is fixed in version 16.1.1.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.
OpenIdentityPlatform OpenAM versions prior to 16.1.1 contain an improper authorization vulnerability in the Liberty Web Services SOAP receiver. This flaw allows unauthenticated remote attackers to write persistent entries into a user's Liberty Discovery store and the shared root-realm Discovery branch. The vulnerability arises because server-side handlers bypass LDAP and identity ACLs, using an internal administrative token for global paths. This can lead to manipulated service-routing or security-mechanism records in deployments consuming Liberty discovery data. The issue is fixed in version 16.1.1.
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record's attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record's persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35.
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cron creation. In deployments with custom resource handlers that register only assistants.read, omit an assistants.search handler, and have no global fallback handler, no applicable handler supplies an owner filter, allowing a low-privileged user to reference another user's private assistant through POST /runs or POST /threads/{thread_id}/runs. The run-creation response can disclose the private assistant's metadata, config, and context, and the run can execute using that assistant's configuration. Deployments without custom authorization handlers, or with an equivalent owner filter applied through a global handler or across all assistant events, are not affected. This issue is fixed in version 0.10.0.
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used.
OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restricted to admin-level accounts. Versions 1.23.0 and 2.10.0 patch the issue.
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.
CVE-2026-80378 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It involves improper authorization that could allow a remote authenticated attacker to cause a denial of service. The vulnerability does not impact confidentiality but can affect integrity and availability.
IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains an improper authorization vulnerability that allows a remote authenticated attacker to delete arbitrary RabbitMQ queues or exchanges, resulting in denial of service. This vulnerability is identified as CWE-285 and has a high severity with a CVSS score of 8.5.
CVE-2026-21097 is an improper authorization vulnerability in Samsung Mobile Devices affecting the ActivityTaskManagerService component prior to the SMR September 2026 Release 1. It allows local attackers with privileged access to launch arbitrary activities without proper authentication. The vulnerability has a medium severity score of 4.6 and requires local privileged access to exploit.
CVE-2026-58611 is a high-severity vulnerability in Microsoft Xbox Gaming Services involving improper authorization. It allows an authorized local attacker to elevate privileges. The issue affects versions from 19.0.0.0 up to but not including 37.114.10001.0. Microsoft has released an official fix in version 37.114.10001.0. No known exploits are reported in the wild.
CVE-2026-53602 is a vulnerability in forgekeep's nebula-mesh prior to version 0.3.7 involving missing authorization checks during certificate issuance and renewal. This flaw allows a host that should be revoked or unauthorized to obtain a fresh, valid Nebula certificate because revocation and operator status are not properly re-evaluated at sign or re-enroll time. The issue is fixed in version 0.3.7.