4813 matches found
CVE-2026-108795
A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the System Settings API component. Specifically, an unknown functionality in the file /base/api/systemSettings suffers from improper access controls (CWE-284, CWE-266). An attacker can initiate this attack remotely to manip...
EUVD-2026-97166
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...
PT-2026-110896
Name of the Vulnerable Software and Affected Versions 1024-lab smart-admin versions prior to 3.30.0 Description An issue exists in the Support Config Query component within the '/support/config/queryByKey' endpoint. Remote manipulation of the configKey argument can lead to improper access control...
PT-2026-110435
Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description Improper access controls exist within the System Settings API component. A remote attacker can exploit this by manipulating the '/base/api/systemSettings' endpoint to gain unauthoriz...
CVE-2026-109615: Missing Authorization
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...
EUVD-2026-96202
Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108...
CVE-2026-8374
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...
CVE-2026-8374
The SwitchBot Door Lock Series is affected by a vulnerability involving the misuse and misconfiguration of cryptographic algorithms during Bluetooth communication. An attacker can exploit a manipulated communication protocol to bypass the electronic lock and gain access to security controls. The ...
CVE-2026-8374 Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...
EUVD-2026-95745
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...
CVE-2026-8374: Generation of Weak Initialization Vector (IV)
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...
PT-2026-108891
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol...
Missing Authorization
Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Missing Authorization via the Kubernetes objects endpoint in KubernetesRouter, where the entity field supplied in the request body ...
CVE-2026-90711
A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...
Ubuntu 22.04 LTS : Go vulnerability (USN-8883-1)
The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8883-1 advisory. It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly...
CVE-2026-96335: Missing Authorization
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...
CVE-2026-102407
A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface API to alter unauthorized data streams. Successful exploitation allows the user to inject data or...