168948 matches found
EUVD-2026-56325
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61356
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-59135
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...
EUVD-2026-56313
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...
CVE-2026-40375 Microsoft Dynamics Business Central Information Disclosure Vulnerability
...
CVE-2026-63516 Microsoft SharePoint Server Spoofing Vulnerability
...
CVE-2026-63516 Microsoft SharePoint Server Spoofing Vulnerability
...
CVE-2026-63516
Deserialization of untrusted data in Microsoft Office SharePoint is the root cause of CVE-2026-63516, leading to spoofing over a network by an authorized attacker. Affected component: SharePoint Server (Microsoft Office SharePoint). CVE notes that exploitation is possible through network access w...
EUVD-2026-56293
Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-62829 Microsoft SharePoint Server Spoofing Vulnerability
...
CVE-2026-57105 Microsoft Office SharePoint Spoofing Vulnerability
...
CVE-2026-62829 Microsoft SharePoint Server Spoofing Vulnerability
...
CVE-2026-62829
CVE-2026-62829 describes an XSS-like input handling flaw in Microsoft Office SharePoint that allows an authorized attacker to perform spoofing over a network. The root cause is the improper neutralization of input during web page generation. Affected product is Microsoft SharePoint Server; the CV...
CVE-2026-58650
CVE-2026-58650 describes an authorization bypass in Visual Studio Code triggered by a user-controlled key, enabling a local attacker to bypass a security feature. The NVD entry lists a CVSS v3.1 base score of 7.8 (HIGH) with Local attack vector, Low attack complexity, and no privileges required, ...
CVE-2026-12571 Authentication Bypass Leading to Account Takeover
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...
CVE-2026-12571
The CVE-2026-12571 entry describes an authentication bypass in ManageEngine DDI Central’s password-reset workflow that enables account takeover. The NVD entry confirms a critical impact (CVSS 3.1: 9.8, NETWORK attack vector, no user interaction) with high impact on confidentiality, integrity, and...
EUVD-2026-56557
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...
CVE-2026-68300
A flaw was found in the Stream Control Transmission Protocol SCTP authentication mechanism within the Linux kernel. The sctpauthchunkverify function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific condition...
CVE-2026-73085
CVE-2026-73085 affects Audiobookshelf prior to version 2.36.0. The issue arises in jwtAuthCheck (server/auth/TokenManager.js): JWTs with the refresh token type are treated as bearer access tokens on API and WebSocket endpoints (e.g., /api/me) instead of being restricted to /auth/refresh, enabling...
CVE-2026-73085 Audiobookshelf: Refresh Token Accepted on Resource Endpoints
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...