External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the caption-download process. An attacker can overwrite or create arbitrary files on the system by supplying a crafted file parameter to the MCP server, allowing modification of files outsid...

CVE-2026-47301

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2026-48489

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...

EUVD-2026-44042

Insufficient granularity of access control in Active Directory Federation Services AD FS allows an authorized attacker to elevate privileges locally...

CVE-2026-58617

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-58545

Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally...

CVE-2026-57102

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-57102

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-57088

Improper access control in Extensible Storage Engine ESENT allows an authorized attacker to elevate privileges locally...

CVE-2026-56157

Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-50502

Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network...

CVE-2026-50495

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

CVE-2026-50462

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

CVE-2026-50465

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

CVE-2026-50423

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-50418

Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-50405

Insufficient granularity of access control in Windows Filtering Platform WFP allows an authorized attacker to elevate privileges locally...

CVE-2026-50373

Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-50335

Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...