CVE-2026-53548 is a critical improper authorization vulnerability in Termix-SSH's Termix platform prior to version 2.6.1. It allows any authenticated user with a valid JWT to enumerate host IDs and retrieve plaintext SSH or sudo passwords of other users by exploiting insufficient host ownership checks on a specific API endpoint. This can lead to unauthorized access and control of managed systems outside the Termix instance. The issue is fixed in version 2.6.1.
Snipe-IT versions prior to 8.4.1 contain an improper authorization vulnerability that allows authenticated users with generic asset edit permissions to delete files attached to assets outside their ownership or company assignment. This is due to insecure direct object reference caused by authorization checks against the object class rather than the specific object instance. The issue is resolved in version 8.4.1.
The PPWP: Password Protect Pages plugin for WordPress contains an improper authorization vulnerability in the can_access function affecting all versions up to and including 1.9.15. This flaw allows authenticated users with Contributor-level access or higher to retrieve the master password and access any password-protected content. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-55166 is a critical improper authorization vulnerability in Netflix Lemur versions prior to 1.9.2. Authenticated users could manipulate the ACME authority URL without proper server-side restrictions, enabling server-side request forgery (SSRF) to internal cloud services and metadata endpoints. Additionally, authorization flaws could allow continued access to private certificate key material after ownership or role changes, with insufficient audit logging to detect such access. The vulnerability could lead to exposure of cloud credentials and long-lived private keys. The issue is fixed in Lemur version 1.9.2 by adding host allowlist validation and improving audit context for key exports.
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input.
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.
CVE-2026-18509 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a local authenticated attacker to escalate privileges via the Navigator for i debugger. Exploitation could lead to unauthorized access or manipulation of sensitive data and creation of new profiles with elevated privileges on the affected IBM i systems.
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an authenticated account holding PROXIED_AUTH assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
Winter CMS versions prior to 1.2.13 contain a vulnerability in the backend module where authenticated backend users can bypass permission checks on the Users controller. This occurs because the backend did not properly validate the _handler POST field, allowing invocation of arbitrary controller methods, including those normally protected. The Users controller was specifically affected due to a null $requiredPermissions setting on the myaccount action, enabling unauthorized user-management operations. The issue is fixed in version 1.2.13.
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
CVE-2026-18367 is a critical privilege escalation vulnerability in Sophos Endpoint for macOS and Sophos Home for macOS. It allows local users to execute arbitrary code with root privileges due to improper or missing authorization checks. The vulnerability affects versions older than 2026.1.1 for Sophos Endpoint and older than 10.11.6 for Sophos Home. The CVSS score is 9.3, indicating a high severity with complete confidentiality, integrity, and availability impact. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students.php. Such manipulation of the argument class_group leads to authorization bypass. The attack may be launched remotely.
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely.
CVE-2026-70472 is an improper authorization vulnerability in FlowiseAI Flowise versions prior to 3.1.3. The issue allows an attacker to use a client-controlled credential parameter to access credentials belonging to other workspaces without proper authorization checks. This can lead to unauthorized use of OpenAI API keys, modification or deletion of victim vector stores and files, and potential billing impact on the victim's OpenAI account. The vulnerability violates multi-tenant boundaries and is fixed in version 3.1.3.