185683 matches found
ROS-20260922-73-0077
The vulnerability in Tomcat11 is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...
PT-2026-96892
Name of the Vulnerable Software and Affected Versions RTI Connext Professional Core Libraries versions 6.1.0 through 6.1.x RTI Connext Professional Core Libraries versions 7.0.0 through 7.3.1.5 RTI Connext Professional Core Libraries versions 7.4.0 through 7.7.0 Description An integer overflow or...
CVE-2026-77252: Improper Access Control
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, caller-supplied projectsfilter and spacesfilter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured...
CVE-2026-18462: Integer Overflow or Wraparound
Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...
ROS-20260922-73-0075
The vulnerability in Tomcat is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...
CVE-2026-76804: Improper Access Control
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...
CVE-2026-83602: Improper Access Control
Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...
CVE-2026-95624: Improper Access Control
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...
CVE-2026-77251: Hardware Child Block Incorrectly Connected to Parent System
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an incomplete case-sensitive space check, and Jira boa...
PT-2026-96694
Name of the Vulnerable Software and Affected Versions open-vsx.org affected versions not specified Description The deployment of the service returned an Access-Control-Allow-Origin header that reflected the requesting origin combined with Access-Control-Allow-Credentials: true on authenticated...
CVE-2026-76803: Improper Access Control
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...
PT-2026-97071
Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote authenticated attacker can access or modify unauthorized resources. This is caused by the use of wildcards in Role-Based Access Control RBAC permission definitions, which is a metho...
PT-2026-97017
Name of the Vulnerable Software and Affected Versions Spree versions 5.4.0 through 5.4.3 Spree versions 5.5.0 through 5.5.3 Description An authenticated customer can associate an eligible guest cart with their own account and access the billing and shipping address data stored within that cart...
ROS-20260922-73-0032
The vulnerability of the aasockmsgperm function in the security/apparmor/lsm.c module of the AppArmor security component of the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrit...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvirt (UTSA-2024-005633)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005633 advisory. A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a...
The vulnerability of the NPM packet manager’s vm2 library, related to deficiencies in access control, allows attackers to compromise the integrity and accessibility of protected information.
The vulnerability of the NPM packet manager’s vm2 library is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of the protected information...
CVE-2026-79316
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...
CVE-2026-67827
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...
CVE-2026-77518
MaxKB (open-source enterprise AI assistant) versions 2.10.2-lts and earlier are affected by an authorization bypass in the MCP tool-detail route, which fails to apply the per-resource authorization check used by the list route. A workspace user who knows another user's active MCP tool_id can retr...