191690 matches found
CVE-2026-86341: Access Control Check Implemented After Asset is Accessed
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38439)
The TOTOLINK T6 is a dual-band wireless Mesh router released by ZhiOn Electronics TOTOLINK. The TOTOLINK T6 contains an access control vulnerability stemming from improper access control in the setScheduleCfg function. An attacker could exploit this vulnerability by sending a specially crafted PO...
PT-2026-93860
Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38433)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the setOpModeCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38424)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setAccessDeviceCfg function. Attackers can exploit this vulnerability by sending a specially crafted PO...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38423)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the NTPSyncWithHost function. Attackers can exploit this vulnerability by sending a specially crafted POST...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38432)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to improper access control. This vulnerability stems from an improper access control in the setNtpCfg function. Attackers can exploit this vulnerability by sending specially crafted...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38411)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delVlanCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reque...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38421)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the killProcess function. Attackers can exploit this vulnerability by sending a specially crafted POST...
PT-2026-93985
Name of the Vulnerable Software and Affected Versions Cisco Secure Adaptive Security Appliance Software affected versions not specified Cisco Secure Firewall Threat Defense Software affected versions not specified Cisco Secure Firewall Management Center Software affected versions not specified...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38437)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setRemoteCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...
CVE-2026-92589: Missing Authorization
Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38583)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability in access control. This vulnerability stems from improper access control in the delSlaveDevice function. Attackers can exploit this vulnerability by sending a specially crafted MQTT message t...
Oracle HTTP Server mod_ssl Unauthorized Access
The vulnerability of the modssl component of the Oracle HTTP Server is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to create, delete, or modify data using the HTTP network protocol...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38560)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setUploadSetting function. Attackers can exploit this vulnerability by sending specially crafted POST...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38572)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setWiFiMeshName function. Attackers can exploit this vulnerability by sending a specially crafted POST...
PT-2026-94024
Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance ASA Software affected versions not specified Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description A logic error in the access control list ACL Object...
SUSE CVE-2026-90711
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...
CVE-2026-88065
tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...