CVE-2026-107334 Incorrect Authorization in Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-107334

The Malcolm software contains an Incorrect Authorization vulnerability in its nginx Lua role-based access control (RBAC) layer. The issue arises because the Lua RBAC layer performs pattern-matching on the raw, percent-encoded request URI , while Nginx selects location blocks using the percent-dec...

CVE-2026-26418

CVE-2026-26418 Absence d'authentification et d'autorisation dans l'API Web Résumé de la vulnérabilité Une vulnérabilité d'absence d'authentification et d'autorisation a été identifiée dans la couche API Web de Tata Consultancy Services TCS – Cognix Recon Client v3.0. Certains points de terminaiso...

CVE-2026-26417

CVE-2026-26417 Contrôle d'accès défaillant dans la fonctionnalité de réinitialisation de mot de passe Résumé de la vulnérabilité Une vulnérabilité de contrôle d'accès défaillant a été identifiée dans Tata Consultancy Services TCS – Cognix Recon Client v3.0. Le problème permettait aux utilisateurs...

CVE-2026-26416

CVE-2026-26416 Vulnérabilité de contournement d'autorisation conduisant à une élévation de privilèges Résumé de la vulnérabilité Une vulnérabilité d'élévation de privilèges a été identifiée dans Tata Consultancy Services TCS – Cognix Recon Client v3.0. Le problème permettait à des utilisateurs...

CVE-2026-10243-AUTH

Smart Parking System 1.0 - Accès non authentifié aux fonctions administratives critiques Informations sur la vulnérabilité Champ| Détails ---|--- Produit| Smart Parking System Vendeur| code-projects.org Version| 1.0 Classe de vulnérabilité| Authentification manquante pour une fonction critique...

CVE-2026-107333 Incorrect Authorization in Malcolm

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control RBAC authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions...

CVE-2026-107333 Incorrect Authorization in Malcolm

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control RBAC authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions...

CVE-2026-50054

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry...

CVE-2026-10631

An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant...

CVE-2026-25232-PoC

CVE-2026-25232 — Contournement de la suppression de branche protégée dans Gogs Escalade Write → Admin Vue d'ensemble Champ| Détails ---|--- CVE| CVE-2026-25232 Produit| Gogs Go Git Service Versions affectées| = 0.13.4 Version corrigée| 0.14.1 Score CVSS| Moyen CWE| CWE-863 : Autorisation incorrec...

CVE-2026-35045-PoC

CVE-2026-35045 — Autorisation au niveau objet cassée dans Tandoor Recipes Résumé Le point de terminaison PUT /api/recipe/batchupdate/ dans Tandoor Recipes v2.6.1 permet à tout utilisateur authentifié au sein d'un Espace de modifier n'importe quelle recette de cet Espace — y compris les recettes...

How one bug bounty researcher chooses the features they investigate

As we kick off Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to spotlight one of the top-performing security researchers participating in the GitHub Security Bug Bounty Program: @vaib25vicky! The security research community makes GitHub safer for everyone--that's the simple...

EUVD-2026-94645

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 Élévation de privilèges StudioCMS via une génération de jeton API non sécurisée NVD • Avis de sécurité • CWE-639 Vue d'ensemble Le point de terminaison POST /studiocmsapi/dashboard/api-tokens dans StudioCMS ≤ 0.3.0 permet à tout utilisateur authentifié au minimum avec le rôle...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Aperçu Ce dépôt contient la preuve de concept PoC pour CVE-2026-24134 , une vulnérabilité de type Broken Object Level Authorization BOLA dans StudioCMS. Contenu cve202624134poc.py - Script d'exploitation en Python Prérequis StudioCMS=0.1.1 pip install requests colorama Démarrag...

CVE-2026-50054 Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry...

CVE-2026-50054

An authorization flaw in the Zimbra Collaboration Suite 's GrantRightsRequest SOAP handler allows an attacker with access to an authenticated account to grant another local account the loginAs right. This creates persistent mailbox access and mail-sending authority that remains active even after ...

EUVD-2026-95097

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry...

CVE-2026-10631 Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier

An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant...