224066 matches found
CVE-2026-47129 NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts
NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...
CVE-2026-44507
Removed by vendor...
CVE-2026-44585
CVE-2026-44585 affects Paymenter prior to v1.5.0. The ticket creation endpoint validates ownership of a user-supplied service identifier is not enforced, enabling an authenticated user to create tickets that reference another user’s service. Impact stated: no direct access to service contents or ...
c-ares: c-ares: Use-after-free / double-free in query-completion handling
A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via aresgetaddrinfo over TCP by sending crafte...
CVE-2026-60030
Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...
CVE-2026-62414
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views...
CVE-2026-62414
The CVE concerns the Joomla extension Page Builder CK (joomlack.fr) with improper access control in frontend page list views. Affected versions are Page Builder CK
CVE-2026-62414 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views...
CVE-2026-62414 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views...
CVE-2026-60030
The CVE-2026-60030 entry concerns Joomla’s Quix Page Builder Pro (thethemexpert extension) with a broken access control in media management. Authenticated users can upload media irrespective of their permissions. The CVE list notes this affects versions before 6.2.1; remediation is to update to 6...
CVE-2026-60030 Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1
Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...
CVE-2026-60030 Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1
Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...
EUVD-2026-46056
The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...
CVE-2026-60030
Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions...
CVE-2026-55645
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...
CVE-2026-64099
A flaw was found in the Linux kernel's drm/v3d graphics driver. This vulnerability, a use-after-free error, occurs in the CPU job input/output control ioctl error path. When an error is encountered, the system attempts to access memory that has already been freed, which can lead to system...
Malicious code in lwc-slds-lbc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...
CVE-2026-55645
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...
CVE-2026-55645 xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...