CVE-2026-2075 yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control

A security flaw has been discovered in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. Affected is the function saveRolePermission of the file dataset\repos\warehouse\src\main\java\com\yeqifu\sys\controller\RoleController.java of the component Role-Permission Binding Handler. The...

ACE SECURITY WiP-90113 访问控制错误漏洞

ACE SECURITY WiP-90113 is a camera product developed by the Japanese company ACE SECURITY. ACE SECURITY WiP-90113 has a vulnerability related to access control. This vulnerability arises from the unprotected configuration of backup endpoints, which may allow unverified attackers to retrieve...

CVE-2026-24920

Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24920

Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24923

Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-2009

A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phpaction/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-2009 SourceCodester Gas Agency Management System createUser.php access control

A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phpaction/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-1898

A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able...

D-Link DIR-605L 访问控制错误漏洞

The D-Link DIR-605L is a wireless router produced by D-Link Corporation. The D-Link DIR-605L versions 2.06B01/2.13B01 and DIR-619L versions 2.06B01/2.13B01 have a vulnerability related to access control. This vulnerability stems from incorrect operations on the Wifi Setting Handler component, whi...

D-Link DIR-605L和D-Link DIR-619L 访问控制错误漏洞

The D-Link DIR-605L and D-Link DIR-619L are wireless routers produced by the Chinese company D-Link. The D-Link DIR-605L versions 2.06B01/2.13B01 and DIR-619L versions 2.06B01/2.13B01 have a vulnerability related to access control. This vulnerability stems from incorrect operations on the...

CVE-2025-70963

Gophish =0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

DeepAudit 安全漏洞

DeepAudit is an automated vulnerability auditing tool developed by lintsinghua’s individual developers. Versions of DeepAudit 3.0.4 and earlier contain security vulnerabilities. These vulnerabilities stem from improper access control on the /api/v1/users endpoint, which may allow any authenticate...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege control vulnerability exists in the Huawei HarmonyOS HDC module, which can be exploited by an attacker to compromise confidentiality...

CVE-2025-70963

Summary: CVE-2025-70963 affects Gophish prior to 0.12.1. The admin dashboard exposes each user’s long‑lived API key directly in the rendered HTML/JavaScript on login, enabling access to permanent API credentials from browser scripts. This is an Incorrect Access Control vulnerability with HIGH imp...

CVE-2025-15342 Tanium addressed an improper access controls vulnerability in Reputation.

Tanium addressed an improper access controls vulnerability in Reputation...

PT-2026-6077

Name of the Vulnerable Software and Affected Versions Wekan versions up to 8.20 Description A flaw exists in Wekan’s LDAP User Sync component, specifically within the packages/wekan-ldap/server/syncUser.js file. This issue results in improper access controls and allows for remote exploitation. Th...

PT-2026-6630

Name of the Vulnerable Software and Affected Versions WeKan versions up to 8.20 Description A flaw exists in WeKan that relates to improper access controls. The issue is located in an unknown function within the server/attachmentMigration.js file of the Attachment Migration component. This issue...

EUVD-2025-206828

Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint page=sslcerts. This allows the...

Tenda D301 and Tenda D151 Access Control Error Vulnerabilities

Tenda D301 is a wireless router.Tenda D151 is a wireless router. An access control error vulnerability exists in the Tenda D301 and Tenda D151 that stems from the presence of an unauthenticated configuration download on the /goform/getimage endpoint, which can be exploited by an attacker to cause...

CVE-2026-25519 OpenSlides has incorrect access control vulnerability in authentication service

OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML via an external ID...