MetaPermit: Scalable and Auditable Access Control for AI Agents Via LLM-Inferred Meta-Attributes

The rise of autonomous AI agents equipped with tools has introduced significant security risks, ranging from unintended tool misuse to adversarial manipulation through Indirect Prompt Injection IPI attacks. In practice, deployed agent systems such as OpenAI Codex and Claude Code protect tool...

EUVD-2026-87081

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

EUVD-2026-87080

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-79153

The Seclore FileSecure Desktop Client before version 3.25.1.0 contains an improper access control vulnerability within its kernel-mode driver component. This flaw allows an authenticated local user to achieve privilege escalation to NT AUTHORITY\SYSTEM on affected systems. No specific exploit cod...

CVE-2026-79153

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems...

CVE-2026-88421

Incorrect access control in the BlogPage.getentries component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed...

Debian dsa-6514 : libapache2-mod-php8.4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6514 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6514-1 [email protected] https://www.debian.org/securit...

CVE-2023-35794-WebSSH-Hijacking

CVE-2023-35794-WebSSH-Hijacking El repositorio contiene la descripción de CVE-2023-35794 descubierta por Dodge Industrial Team para la plataforma Dodge OPTIFY. ID de CVE: CVE-2023-35794 Proveedor: Cassia Networks Producto: Access Controller Versión: Cassia-AC-2.1.1.2303271039 Vulnerabilidad:...

CVE-2025-69428

Aviso de Seguridad - CVE-2025-69428 Título: Acceso no autenticado a directorio sensible Divulgación de información CVE-ID: CVE-2025-69428 Descripción Una vulnerabilidad crítica de control de acceso en la aplicación Pro-Bit desplegada localmente en versiones anteriores a la v1.77.4 permite a...

CVE-2025-24000-exploit

CVE-2025-24000 — Exploit de escalada de privilegios en Post SMTP Resumen Este script explota la CVE-2025-24000 , una vulnerabilidad de control de acceso roto de alta gravedad en el plugin Post SMTP para WordPress versiones ≤ 3.2.0. Permite que cualquier usuario autenticado con una cuenta de bajos...

EUVD-2026-66213

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

zeroheight-account-verification-bypass-CVE-2025-65925

CVE-2025-65925 — Control de Acceso Incorrecto en el Flujo de Creación de Cuentas de Zeroheight Fecha de divulgación: 2025-06-11 Fecha de corrección del proveedor según el proveedor: 2025-06-13 Fecha de validación del investigador: 2025-06-26 Descubierto por: Sneden Rebello Resumen Una ruta API...

vRealizeLogInsightRCE

VMSA-2023-0001 POC para VMSA-2023-0001 que afecta a VMware vRealize Log Insight e incluye los siguientes CVEs: Vulnerabilidad de Directory Traversal en VMware vRealize Log Insight CVE-2022-31706 Vulnerabilidad de control de acceso roto en VMware vRealize Log Insight CVE-2022-31704 VMware vRealize...

CVE-2026-86858

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNo...

CVE-2026-77293

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and...

cve-2026-86060

CVE-2026-86060 — Escalada de privilegios preautenticación en SSH de MikroTik RouterOS hasta el control administrativo total Campo| Valor ---|--- CVE| CVE-2026-86060 Producto| MikroTik RouterOS servicio SSH Versiones afectadas| RouterOS 6.x y 7.0.0 – 7.23.3 inclusive Versiones corregidas| RouterOS...

CVE-2026-73318

CVE-2026-73318: Missing authorization on force-agreement actions XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement. What happens The ACP navigation entries are limited to administrators with the option permission, but ForceAgreementController...

CVE-2026-21962

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server Proxy Plug-in Bypass de Control de Acceso mediante Inconsistencia en la Normalización de URI Un exploit y análisis reproducidos de forma independiente para CVE-2026-21962 control de acceso inadecuado, CVSS 10.0 en Oracle HTTP Server / el Proxy...

forticlient_ems_cve_2026_35616_poc.py

markdown CVE-2026-35616 - FortiClient EMS API Authentication Bypass Detector ⚠️ CRITICAL SECURITY VULNERABILITY ⚠️ CVSS Score: 9.1 | CWE-284: Improper Access Control FortiClient EMS versions 7.4.5 through 7.4.6 📋 Descripción Este detector identifica si un servidor FortiClient EMS es vulnerable a...

CVE-2026-86858

An improper access control security issue exists in the ServiceNow AI Platform , which could allow an unauthenticated user to create, modify, or delete instance data beyond intended limits. The CVELIST document specifies this as an Unauthenticated Privilege Escalation via GraphQL . ServiceNow rel...