190601 matches found
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Blocksy Companion versions = 2.1.55...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a malicious file. Chromium security severity: Medium...
CVE-2026-78313
Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...
CVE-2026-78313
The DIAEnergie software is affected by an Improper Access Control vulnerability in versions before 1.11.00.022 . While the specific root cause is not detailed in the provided documents, the vulnerability allows for a HIGH confidentiality impact. The CVSS v3.1 score is 6.5 (MEDIUM) , with a networ...
CVE-2026-78313 Improper Access Control in DIAEnergie
Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...
CVE-2026-78313 Improper Access Control in DIAEnergie
Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...
EUVD-2026-85823
Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...
OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files
An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and...
CVE-2026-82849
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...
EUVD-2026-85809
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
EUVD-2026-85803
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites wher...
CVE-2026-88847
The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) is vulnerable to an authentication bypass flaw where it fails to verify if a user is enrolled in a course before recording lesson completions. This allows any authenticated user , such as a subscriber, to create unauthorized course pr...
CVE-2026-97177
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...
kernel: selinux: check connect-related permissions on TCP Fast Open
A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network...
CVE-2026-96763 kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...
CVE-2026-96763 kvcache-ai mooncake MountSegment Request Processing segment.cpp access control
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...
CVE-2026-79758: Improper Access Control
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...
CVE-2026-86858: Improper Access Control
ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNo...
CVE-2026-85057: Improper Access Control
ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...
CVE-2026-96763: Improper Access Control
A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...