227548 matches found
PT-2026-55492
Name of the Vulnerable Software and Affected Versions ASUS Business Manager affected versions not specified Description An External Control of File Name or Path issue allows a local user to execute arbitrary code with SYSTEM privileges. This is achieved by tampering with an Inter-Process...
ROS-20260703-73-0021
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260703-73-0014
The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260703-73-0008
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-55659
Name of the Vulnerable Software and Affected Versions Microsoft Edge for Android affected versions not specified Description Improper access control allows an unauthorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no information about a newer...
CVE-2026-26145
Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network...
CVE-2026-26145
Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network...
CVE-2026-12413
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...
CVE-2026-38971
ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...
External Control of File Name or Path
Overview recce is an Environment diff tool for dbt Affected versions of this package are vulnerable to External Control of File Name or Path via the query run API when configured with a DuckDB-backed project. An attacker can access or modify local files accessible to the server process, potential...
EUVD-2026-37801
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header...
GHSA-2JRW-C95W-H43G Mautic has an Authorization Bypass in API v2 Endpoints
Summary An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints utilizing API Platform. Under certain conditions, roles configured with owner-scope restrictions such as viewown or editown are not properly enforced. This allows low-privilege authenticated API users to bypass...
EUVD-2026-41429
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...
CVE-2026-59098 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...
CVE-2026-59098 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...
CVE-2026-59098
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...
GHSA-43CQ-C2GQ-PFPW Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Summary The EntriesController::actionMoveToSection endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current secti...
CVE-2026-38057
creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:11+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01 2026-07-10 21:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd56jbznv2f 2026-07-12 11:00:54+00:00| seen|...
CVE-2026-54477
creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:07+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 2026-07-03 02:37:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppjau64lu2s 2026-07-03 18:59:03+00:00| seen|...
CVE-2026-13768
creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:03+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 2026-07-03 00:00:42+00:00| seen| https://infosec.exchange/users/offseq/statuses/116853102484273046 2026-07-03 00:00:46+00:00| seen|...