CVE-2026-19198

Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Akaunting

Products

Akaunting

CVE-2026-103907

Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109302

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Parse Community Parseplatform

Products

Parse Server Parse-server

CVE-2026-33391

Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nozomi Networks

Products

Cmc Guardian

CVE-2026-33388

Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Nozomi Networks

Products

Cmc Guardian

CVE-2026-110622

Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Papermerge

Products

Papermerge

CVE-2026-105848

Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload Plugin-stripe

CVE-2026-105849

Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-105851

Payload: Field access control bypass on auth collections

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-105852

Payload relationship-query authorization bypass

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-105859

Payload: Unauthorized update to collection documents

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-105860

Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload

CVE-2026-105864

Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload Plugin-multi-tenant

CVE-2026-14273

IBM DataPower Gateway Incorrect Authorization

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 and 2 more

CVE-2026-16275

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2026-74769

Incorrect Authorization in PowerProtect Data Manager REST API Allows Protection Mechanism Bypass

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Powerprotect Data Manager

CVE-2026-110762

bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bbpress

Products

Bbpress

CVE-2026-9268

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2026-92528

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2026-85529

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab