191363 matches found
PT-2026-90510
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...
PT-2026-90151
Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An object-level authorization failure occurs when updating a Page Type. The Types::submit dashboard controller processes the ptID variable provided by the user to load and save a Page Type witho...
PT-2026-89790
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and r...
PT-2026-89897
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5...
PT-2026-90033
Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...
CVE-2026-84390: Inclusion of Sensitive Information in Source Code
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via...
ROS-20260911-73-0214
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by downloading the malicious extension...
ROS-20260911-73-0201
The vulnerability in the Google Chrome web browser is related to access control errors. Exploiting this vulnerability could allow a malicious actor to trigger a service failure through a specially created HTML page...
ROS-20260911-73-0202
The vulnerability of the Link Preview function in browsers such as Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...
PT-2026-90519
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The application implements a fail-open access control mechanism in its role-authorization lookup. When a request handler's name is missing from the role...
PT-2026-89789
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...
PT-2026-90276
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Landlock security module regarding the creation of whiteout objects in OverlayFS. Whiteout objects are used in the upper layer of an OverlayFS to indicate that a...
ROS-20260911-73-0090
The vulnerability of the WebHID component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
PT-2026-90030
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...
FreeBSD : immich -- locked assets remain accessible through shared albums and links (fcc6917b-adbc-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fcc6917b-adbc-11f1-a655-3497f65b111b advisory. VulnCheck reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets a...
GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...
GHSA-4QPV-39HG-F7FX @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...
