CVE-2026-44595

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one...

CVE-2026-6511

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system...

EUVD-2026-44974

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system...

CVE-2026-6511

CVE-2026-6511 : Lenovo Smart Connect for Windows is reported to have an improper access control vulnerability that could allow a local authenticated user to access files owned by another user on the same system. The issue is described as local, with low attack complexity and the attack requires l...

CVE-2026-9292

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:41+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-09...

CVE-2026-15352

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:39+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-03 2026-07-16 23:23:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsewl6cyb2e 2026-07-30 23:00:46+00:00| seen|...

CVE-2026-8314

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:36+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01 2026-07-21 09:01:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5h3pkxqd23 2026-07-21 09:01:17+00:00| seen|...

CVE-2026-8313

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:34+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01 2026-07-21 08:30:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5ffdinfx2p 2026-07-21 08:30:43+00:00| seen|...

CVE-2026-12659

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:28+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-08...

CVE-2026-11889

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:25+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-07...

CVE-2026-57896

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:19+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

CVE-2026-60140

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:16+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

CVE-2026-61389

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:14+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

CVE-2026-60063

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:12+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

EUVD-2026-44960

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the...

CVE-2026-55548

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the...

CVE-2026-55548

In Yamcs, CVE-2026-55548 affects the PacketsApi.exportPackets endpoint. The root cause was failure to enforce per-packet ReadPacket privileges when a request supplied an empty packet-name list, causing no WHERE pname IN filter and the onTuple handler to stream packets without per-row authorizatio...

CVE-2026-63082

Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can a...

WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Averon Averenkov in WordPress Plugin Autopay dla WooCommerce versions = 2.2.27...

CVE-2026-35148

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of...