168776 matches found
CVE-2026-44380
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within...
CVE-2026-44424
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller's namespace tenant. Any authenticated user JWT or API Key who knows or can guess a device UID...
CVE-2026-44380 MISP: Improper access control in auth key reset allows privilege escalation to site administrator
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within...
CVE-2026-44380
CVE-2026-44380 (MISP) is an improper access-control flaw in the authentication key reset feature present before version 2.5.37. An authenticated organization administrator could reset auth keys for site administrator accounts within the same organization, since non-site administrators were not ex...
EUVD-2026-30167
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within...
CVE-2026-41100
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally...
CVE-2026-41614
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally...
CVE-2026-32209
Improper access control in Windows Filtering Platform WFP allows an authorized attacker to bypass a security feature locally...
CVE-2026-42823
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-42832
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally...
CVE-2026-41101
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally...
CVE-2026-41102
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally...
CVE-2026-41086
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-40420
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally...
CVE-2026-40381
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...
CVE-2026-40365
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
CVE-2026-35436
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally...
CVE-2026-33834
Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally...
Insufficient Granularity of Access Control
Overview github.com/grafana/grafana/pkg/api is an open and composable observability and data visualization platform. Affected versions of this package are vulnerable to Insufficient Granularity of Access Control via the annotation deletion process. An attacker can remove data outside their...
