99 matches found
ble-cve2025-attack-new-version
ble-cve2025-attack-new-version android-ble-cve-2025-4866 🔐 PoC para CVE-2025-4866 — Vulnerabilidad BLE de Android versión pública 📡 Explotación de debilidades en la autorización BLE en dispositivos Android public PoC only. 👨💻 Desarrollado por BloodCode Labs — 2025...
CVE-2026-70550
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...
CVE-2026-70550
JFrog Artifactory 's Composer repository handling contains an authorization weakness that may allow an authenticated user , under specific conditions, to read package metadata from repositories they are not authorized to access. The issue primarily impacts confidentiality and was scored CVSS 3.1:...
CVE-2026-70550 Potential unauthorized access to private Composer repository metadata in JFrog Artifactory
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...
EUVD-2026-65546
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...
CVE-2026-55166
Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or...
CVE-2026-48086
OpenReception’s appointment-booking software (pre‑1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...
CVE-2026-16070
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...
CVE-2026-65922
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...
CVE-2026-65922 Potential unauthorized modification of Artifactory internal metadata
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...
CVE-2026-65922
Technical details for CVE-2026-65922 are not publicly provided in the supplied documents; monitor for updates.
CVE-2026-65922 Potential unauthorized modification of Artifactory internal metadata
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...
EUVD-2026-49583
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...
PT-2026-65110
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...
EUVD-2026-45094
OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact...
PYSEC-2026-2714 Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
Summary Any authenticated user with low privileges can enumerate active background tasks across the system and stop tasks belonging to other users via the GET /api/tasks and POST /api/tasks/stop/taskid methods. This allows a casual user to disrupt system-wide chat usage by continuously canceling...
CVE-2026-15318 Sipeed PicoClaw MQTT Channel mqtt.go authorization
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument clientid causes incorrect authorization. The attack is possible to be...
CVE-2026-54012
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the...
CVE-2025-62180
The CVE concerns Pega Platform versions 8.3.0 through Infinity 25.1.2, affected by an authorization weakness that may let authenticated users access additional data via crafted URLs. The vulnerability is described with a high impact on confidentiality (VULNERABLE SYSTEM CONFIDENTIALITY: HIGH) and...