165844 matches found
[20260805] - Core - Improper ACL checks for category webservice endpoints
An improper access check allows unauthorized users to create categories for inaccessible components...
[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints
An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...
PT-2026-60308
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified HashiCorp Vault versions prior to 1.16.8 HashiCorp Vault versions prior to 1.17.4 Description In the Linux kernel, a NULL pointer dereference occurs in the gfx v12 1 wait reg mem function during...
ROS-20260715-73-0007
The vulnerability of the Apache HTTP Server is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
CVE-2026-36035
Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...
GHSA-MF78-3RPF-R784 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
Summary Anyquery's server mode lacks input sanitization and access control over its built-in SQLite virtual table modules e.g., csvreader, logreader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system e.g.,...
CVE-2026-48489
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...
CVE-2026-47301
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...
CVE-2026-48489
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...
EUVD-2026-44042
Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...
CVE-2026-58617
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-58545
Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally...
CVE-2026-57088
Improper access control in Extensible Storage Engine ESENT allows an authorized attacker to elevate privileges locally...
CVE-2026-56157
Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
CVE-2026-50502
Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network...
CVE-2026-50495
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...
CVE-2026-50465
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...
CVE-2026-50423
Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally...