AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

CVE-2019-19550

CVE-2019-19550 説明 Senior Rubiweb 6.2.34.28 および 6.2.34.37 におけるリモート認証バイパスにより、脆弱なバージョンを使用する影響を受けたユーザーの機密情報への管理者アクセスが許可されます。攻撃者は正しいURLを提供するだけで済みます。 重要な日付 ベンダーへの通知: 2019-12-02 公開日: 2020-01-30 脆弱性の種類 不適切なアクセス制御 製品ベンダー Senior 影響を受ける製品コードベース Rubiweb - 6.2.34.37 Rubiweb - 6.2.34.28...

CVE-2026-87149

This vulnerability affects Oracle Contract Lifecycle Management for Public Sector (component: Award/PO ) in Oracle E-Business Suite, versions 12.2.8 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit it with low complexity to achieve unauthorized access to critic...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

BlueZ HID over GATT Profile: Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected BlueZ installations. Authentication is not required to exploit this vulnerability. The specific flaw lies in the...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A flaw in incorrect access control in the Linux kernel’s USB core subsystem was discovered in the way users attach USB devices. A local user could exploit this flaw to crash the system...

PT-2026-91147

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

CVE-2026-87047

Tanium Comply is affected by an improper access controls vulnerability, assigned CVSS 3.1 score of 6.3 (Medium) with a network attack vector, low complexity, and low required privileges, resulting in low impacts to confidentiality, integrity, and availability. The vulnerability has been addressed...

CVE-2026-69267

Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-178)

Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: Fixes should be...

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

PT-2026-84835

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

EUVD-2026-42984

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...

CVE-2026-77701 WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to an access control vulnerability in AFT web app ( CVE-2026-1264 )

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed access control security vulnerability Vulnerability Details CVEID:CVE-2026-1264 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, 6.2.1.0 throu...

CVE-2026-51640

Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-19223

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-28190

CVE-2026-28190 is a Broken Access Control vulnerability in the ProLancer Element WordPress plugin, affecting versions 1.4.8 and earlier . The flaw allows users with the Subscriber role to perform actions beyond their intended privilege level, resulting in primarily integrity impact and minor avai...

PYSEC-2026-3648 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

CVE-2026-18200

The FoodBoxBooker WordPress plugin, in versions prior to 1.0.8 , contains an authorization bypass vulnerability. The plugin fails to verify that the user account being updated belongs to the user initiating the request. This allows authenticated users with Subscriber-level access and above to mod...

CVE-2026-19359 nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...