162 matches found
PT-2026-96825
Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The 'POST /login' endpoint in lightrag/api/lightrag server.py does not implement rate limiting, account lockout, delays, or counters for failed authentication attempts. This allows a network attacke...
CVE-2026-88895: Improper Authentication
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...
CVE-2026-82067
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...
EUVD-2026-72954
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...
CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...
CVE-2026-82067: Improper Handling of Case Sensitivity
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...
PT-2026-87160
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description Improper handling of case sensitivity in the configuration validation component may cause the authorization subsystem to remain in a default disabled state during server startup. This...
CVE-2025-12737 Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...
USN-8705-1 zfs-linux vulnerability
It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resulting in an authorization bypass...
CVE-2026-79619: Incorrect Authorization
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrativ...
CVE-2026-16835
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...
EUVD-2026-62691
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...
CVE-2026-16835
CVE-2026-16835 is a CRITICAL (CVSS 9.6) vulnerability in the FSP management network protocol of IBM Power Systems Firmware, caused by improper certificate validation (CWE-295). An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation...
CVE-2026-50622
Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...
CVE-2026-50622
A missing authorization vulnerability exists in Apache Atlas affecting versions 0.8 through 2.5.0 . The flaw allows any authenticated user to bypass role-based access controls and perform administrative operations on the system's admin endpoints . To remediate this issue, users are recommended to...
CVE-2026-50622: Missing Authorization
Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...
CVE-2026-21824 A privilege escalation vulnerability affects HCL Commerce
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...
CVE-2026-21824: Incorrect Privilege Assignment
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...