47 matches found
CVE-2026-79993: Missing Authorization
The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...
EUVD-2026-79140
On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces SVI in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop...
CVE-2026-77191
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...
CVE-2026-75943
A brief milliseconds to seconds traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement...
CVE-2026-77191: Missing Authorization
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...
CVE-2026-75943: Incomplete Cleanup
A brief milliseconds to seconds traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement...
PT-2026-91751
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...
CVE-2026-54258 Cross-monitor event media authorization bypass in direct event media endpoints
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...
EUVD-2026-69945
Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing: from n/a through 6.1.1...
PT-2026-78485
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...
PT-2026-69874
Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.0.3 Vault Enterprise versions prior to 2.0.3 Vault Enterprise versions prior to 1.21.8 Vault Enterprise versions prior to 1.20.13 Vault Enterprise versions prior to 1.19.19 Description The ACL policy...
PT-2026-69122
Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.19.1 through 2.0.2 Consul Enterprise versions 1.19.1 through 2.0.2 Description An authorization bypass exists in the transaction API where the session:write ACL permission is not enforced during session...
CVE-2026-46549 NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauthscope and oauthgrantedresources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope e.g. MCP-only therefore inherited...
CVE-2026-49186
The local MQTT broker does not enforce topic-level Access Control Lists ACLs. This allows any client to subscribe using wildcard characters or + to enumerate hidden network devices or publish rogue control commands...
CVE-2016-10852
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem SEC-85...
EUVD-2021-1487
Malware in sbrugna...
EUVD-2005-1348
Malware in sbrugna...
EUVD-2016-1846
Malware in sbrugna...