CVE-2026-96384 is an incorrect authorization vulnerability in the Drupal Mermaid Diagram Field module versions 1.0.4 through 1.0.8. It allows forceful browsing due to improper access control. The issue was fixed in version 1.0.9. The vulnerability has a low severity score and does not impact confidentiality, integrity, or availability significantly.
CVE-2026-114715 is an incorrect authorization vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw exists in the Modoboa driver of the password plugin, where the driver incorrectly selects the first account from the search results instead of verifying the authenticated user. This could allow a user to change the password of another account. The issue was fixed by ensuring the driver matches the username exactly and fails if no match is found.
CVE-2026-12664 is an authorization vulnerability in GitLab CE/EE versions from 18.2 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It allows an authenticated user with a read_api-scoped token to bypass scope restrictions and retrieve a project's incoming email address and create work items due to insufficient scope enforcement on a GraphQL field. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-16255 is an authorization vulnerability in GitLab EE versions from 12.0 up to but not including 19.3.6, from 19.4 up to but not including 19.4.3, and from 19.5 up to but not including 19.5.1. When the instance-wide SAML or LDAP membership lock was enabled, authenticated users could grant or accept project and group membership outside the identity provider's control due to incomplete enforcement of the membership lock on requests created before the lock was enabled. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-103515 is an authorization vulnerability in GitLab EE versions 19.2 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1. It allows an authenticated user with group Owner permissions to re-enable AI-backed data egress to a third-party service for a group and its descendant projects, even when an instance administrator has locked the group's Duo availability. This occurs due to insufficient granularity in the enforcement of admin-lock controls. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-111812 is a critical authorization vulnerability in Apache Traffic Server's origin_server_auth plugin. It allows a client to force the proxy to sign attacker-chosen AWS request headers using the proxy's own credentials. This flaw affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1. The vulnerability has a CVSS score of 10.0, indicating critical severity.
CVE-2026-105942 is an authorization vulnerability in Apache Pulsar affecting versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5. The flaw allows a proxy role to authorize requests on behalf of another user (the original principal) incorrectly, potentially granting elevated permissions if the proxy's token includes superuser or tenant admin roles. Additionally, tenant admin checks may succeed based solely on the proxy role if it is a tenant admin, allowing unauthorized tenant administration. Fixed versions ensure both proxy and original principal are authorized correctly with their own credentials.
CVE-2026-105938 is an authorization bypass vulnerability in Apache Pulsar affecting subscription-related admin REST API operations. Certain namespace-level and bundle-level operations, such as clearing backlog, unsubscribing, and expiring messages for subscriptions, did not enforce subscription-level authorization policies properly. This allows authenticated users with consume permission on a namespace or topic to perform these operations on subscriptions they are not authorized to access. The vulnerability impacts the integrity of subscription state by allowing unauthorized clearing or expiring of message backlogs and deletion of subscriptions without requiring tenant admin or superuser privileges. It does not allow reading message contents or affect broker availability. The issue is fixed in Apache Pulsar versions 4.0.14 and 4.2.5.
CVE-2026-105930 is an authorization vulnerability in Apache Pulsar affecting deployments with authentication, authorization, and package management enabled. It allows an authenticated user with permission to register or update functions, sources, or sinks in their own tenant namespace to access package contents stored in another tenant's namespace without having explicit package permissions there. The issue leads to disclosure of package contents, which may include sensitive application code or credentials, but does not allow modification or deletion of packages or affect service availability. The vulnerability affects Apache Pulsar versions from 2.8.0 before 4.0.14, from 4.1.0 through 4.1.3, and from 4.2.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5 and later.
CVE-2026-105927 is an authorization vulnerability in Apache Pulsar's WebSocket service that allows an authenticated user with consume permission on a topic to inject messages into arbitrary topics via the deadLetterTopic parameter without having produce permission on those topics. This occurs because the WebSocket service does not verify produce permissions on the dead letter topic and uses its own broker client identity to write messages. The vulnerability affects Apache Pulsar versions from 2.3.0 before 4.0.14 and from 4.1.0 before 4.2.5. The impact is limited to unauthorized message injection; it does not allow reading, modifying, or deleting existing messages. The issue can be mitigated by upgrading to fixed versions or disabling the WebSocket service if not needed.
Nuxt versions prior to 4.6.2 have a case sensitivity mismatch between page resolution and server-side route-rule matching. This allows requests with paths differing only by letter case to bypass intended server rules such as redirects, headers, proxy settings, and SSR controls. Applications that set router.options.sensitive: true in nuxt.config are not affected. The issue is fixed in version 4.6.2.
A vulnerability in Nuxt versions from 3.11.0 up to but not including 3.21.4 and from 4.0.0 up to but not including 4.4.4 allows percent-encoded URL segments to bypass route rule checks. This causes appMiddleware to be skipped during server-side rendering, enabling unauthenticated users to access protected pages and their server-rendered data. The issue also affects app-manifest rules such as redirect, appLayout, ssr, prerender, and payload flags. The vulnerability is fixed in Nuxt versions 3.21.4 and 4.4.4.
CVE-2026-114490 is an incorrect authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.6. It affects the COM administration API, allowing accounts assigned the serveradmin role with a domain list to gain full server administrator privileges, bypassing intended domain restrictions. This enables unauthorized access to read, modify, and manage all domains and accounts on the server. The vulnerability also affects domainadmin roles with domain lists, granting broader access than intended. Accounts with serveradmin role but no domain list and other roles like help desk or auditor are not affected.
CVE-2026-114476 is an authorization vulnerability in the REST administration API of Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.6. It allows a remote authenticated user with manage_roles permission in certain domains or an account with the serveradmin role to escalate privileges to full server administrator authority by exploiting a flaw in role removal logic. Specifically, the API route for deleting role assignments does not properly verify post-removal permissions, enabling privilege escalation and unauthorized administrative access.
CVE-2026-114473 is an incorrect authorization vulnerability in the Sender Rewriting Scheme (SRS) implementation of Progressive Robot Ltd's hMailServer versions 6.2.1 through 6.3.6. The flaw allows a remote attacker holding a valid SRS address to relay mail through the server to external addresses without proper SMTP authentication. This occurs because the server treats all messages to valid SRS addresses as local deliveries, bypassing relay rules. SRS is disabled by default.
CVE-2026-114463 is an authorization vulnerability in Nous Research Hermes Agent affecting versions up to 2026.8.19. The issue arises because the webhook platform gateway constructs session chat IDs using a string format that includes the route name, which can contain colons. This allows an attacker who possesses the target HMAC to manipulate the route name parsing and gain access to higher-privileged toolsets than authorized.
CVE-2026-87096 is an authorization vulnerability in Acronis Cyber Infrastructure (ACI) that allows sensitive information disclosure and manipulation due to improper authorization checks. The issue affects versions prior to builds 6.0.1-112, 6.1.1-64, and 6.2.1-71. The vulnerability has a low severity rating with a CVSS score of 3.3.
CVE-2026-87095 is a critical vulnerability in Acronis Cyber Infrastructure (ACI) involving incorrect authorization checks. This flaw allows unauthorized actors to disclose and manipulate sensitive information. The issue affects versions prior to builds 6.0.1-112, 6.1.1-64, and 6.2.1-71. A fix is available in these builds.
CVE-2026-70387 is a high-severity vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. The issue arises from an exposed dangerous method in the olc2 logging HAL that allows arbitrary command execution with elevated privileges due to insufficient authorization checks. The vulnerability enables processes with certain privileges to execute shell commands in a highly privileged SELinux context, potentially leading to full system compromise. Fixed versions are 15.0.0.2000 and 16.0.5.1200.