CVE-2026-110209

ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Stonewuu

Products

Ai-fusion-video

CVE-2026-110210

Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted secret events and decrypt values using their wrapped environment key.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Phase

Products

Phase Console

CVE-2026-110629

VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Venturedrake

Products

Laravel-crm

CVE-2026-109427

Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Weebzone

Products

Telegram-stremio

CVE-2026-43696

Touch Bar Content Capture via Authorization Flaw in macOS

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-110117

SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController

SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable login lockout and two-factor login, weaken password rules, and clear lockout records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

1024-lab

Products

Smartadmin

CVE-2026-110110

JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jetlinks

Products

Jetlinks Community

CVE-2026-110105

B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes

B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

B3log

Products

Symphony

CVE-2026-110100

Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jorani

Products

Jorani

CVE-2026-115598

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress Learnpress

CVE-2026-111638

sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys

sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Moul

Products

Sshportal

CVE-2026-111683

Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Allegro

Products

Ralph

CVE-2026-109369

WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Murgroland Wordpress-extensions

Products

Wp Booking System – Booking Calendar Wp Booking System

CVE-2026-93328

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Mcp Toolbox For Databases

CVE-2026-116388

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-112839

WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a through 1.3.14.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-76308

Missing Authorization through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk

CVE-2026-76304

Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator (URL) of the Splunk SOAR instance, the container image location, and the Splunk SOAR Automation Broker version. The vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit permission. For more information see Install Splunk Automation Broker on a Docker host (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/install-and-create-classic-splunk-soar-automation-brokers/install-splunk-automation-broker-on-a-docker-host) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk

CVE-2026-109356

LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Librenms

Products

Librenms

CVE-2026-109171

yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Guchengwuyue

Products

Yshop-crm