medium5.3
CVE-2026-77152
Field Collection for Drupal 7 access bypass via missing parent entity access check
Drupal · Field Collection for Drupal 7
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
59 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high8.1
CVE-2026-62989
Shopper: missing variant-delete authorization permits destructive single and bulk actions
shopperlabs · shopper
low3.5
CVE-2026-119330
Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
immich-app · immich
medium6.5
CVE-2026-55551
ZAC: Missing per-zaaktype authorization on by-ID decision and process reads
infonl · dimpact-zaakafhandelcomponent
critical9.0
CVE-2026-112905
Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
givanz · Vvveb
medium6.5
medium5.3
CVE-2026-113696
Improper Authorization in BMC ITSM SmartIT Change Approvals
BMC · BMC IT Service Management Suite
medium5.3
CVE-2026-113694
Improper Authorization in BMC ITSM SmartIT Attachments
BMC · BMC IT Service Management Suite
medium5.6
CVE-2026-42949
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809).
frangoteam · Frangoteam
critical9.8
CVE-2026-42922
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).
frangoteam · Frangoteam
high8.9
CVE-2026-103506
SSO settings authorization bypass
Grafana · Grafana Enterprise / Grafana · Grafana OSS
medium6.1
CVE-2026-118173
MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement
MISP · misp-guard
medium5.3
medium6.5
CVE-2026-116384
Bdtask Garage 24 Garage Management Software Backend improper authorization
Bdtask · Garage 24 Garage Management Software
high7.5
CVE-2026-116368
DeepSeek Harness Browser Auth browser-auth.ts improper authorization
DeepSeek · Harness
medium5.3
CVE-2026-116340
iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization
iFlytek · astron-agent
critical9.2
CVE-2026-116199
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
grokability · snipe-it
medium5.3
CVE-2026-115803
Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
n/a · Scada-LTS
high7.1
CVE-2026-115477
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
The-40-Thieves · obsidian-tc
high7.5
CVE-2026-114249
dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
dhikshitha29 · Insurance-Management-System
high7.5
CVE-2026-84748
Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
Apache Software Foundation · Apache bRPC
critical10.0
CVE-2026-81212
DataStage on Cloud Pak for Data Improper Authorization
IBM · DataStage on Cloud Pak for Data
medium6.5
CVE-2026-91245
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).
Oracle Corporation · Oracle WebCenter Portal
medium5.5
CVE-2026-86976
An authorization issue was addressed with improved state management.
Apple · iOS and iPadOS / Apple · macOS
high7.1
CVE-2026-112188
MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
MISP · MISP
medium6.5
CVE-2026-54683
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)
nl-portal · nl-portal-backend-libraries
high7.8
CVE-2026-70218
Windows StateRepository API Elevation of Privilege Vulnerability
Microsoft · Windows 11 Version 24H2 / Microsoft · Windows 11 Version 25H2
high7.5
CVE-2026-97324
YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization
YunaiV · ruoyi-vue-pro / zhijiantianya · ruoyi-vue-pro
critical9.9
CVE-2026-85878
Azure Database for PostgreSQL Elevation of Privilege Vulnerability
Microsoft · Azure HorizonDB
critical10.0