191727 matches found
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38581)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability in access control. This vulnerability stems from an incorrect access control in the UploadFirmwareFile function. Attackers can exploit this vulnerability by sending a specially crafted POST...
CVE-2026-87959: Improper Access Control
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...
CVE-2026-92780: Missing Authorization
KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...
CVE-2026-92776: Incorrect Authorization
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...
CVE-2026-92754: Missing Authorization
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...
CVE-2026-61596: Authorization Bypass Through User-Controlled Key
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...
CVE-2026-20322: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-20192: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...
CVE-2026-20120: Improper Access Control
A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...
PT-2026-93305
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38565)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setWanIeCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...
PT-2026-94057
Name of the Vulnerable Software and Affected Versions KnowStreaming versions prior to 3.4.2 Description Failure to enforce role-based access control on REST API endpoints allows any authenticated user to access protected functionality. This enables attackers to call identity-management endpoints ...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38564)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setWanCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reque...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38586)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the guestwifisync function. Attackers can exploit this vulnerability by sending a specially crafted MQTT...
ROS-20260916-73-0035
The vulnerability in the kernel-lt is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38428)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setIpPortFilterRules function. Attackers can exploit this vulnerability by sending a specially crafted...
PT-2026-94106
Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.12 Description A broken access control flaw exists in the 'actions/nested-elements/reorder' endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries permissions but lacking...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38405)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an error in the delMacFilterRules function. Attackers can exploit this vulnerability by sending a specially crafted POST request to th...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38593)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the recvClearPairCfg function. Attackers can exploit this vulnerability by sending a specially crafted MQT...