277796 matches found
PT-2026-109035
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
PT-2026-109054
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
PT-2026-102654
Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description The QUIC stack fails to enforce connection-level flow control for streams, although it correctly enforces stream-level limits. A remote peer can bypass the intended connection flow control...
CVE-2025-33207: Improper Access Control for Register Interface
NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...
RISK: Auditing Industrial Control Systems for Too-Late-To-Recover Vulnerabilities
The security of industrial control systems ICS is important. Yet most ICS security efforts focus on the detection of ICS attacks, with much less attention to the recovery after detection. In this paper, we address this underexplored area by jointly auditing the detection and recovery of ICS...
A Competing-Hazards Systematization of Loss of Control in Autonomous Agents
Leading AI developers have reported agents acting beyond their approved limits, which a United Nations panel described as an early warning of loss of human control. Yet incident reports and agent-safety evaluations describe these events differently, making it difficult to compare failures, trace...
CVE-2026-92223: Improper Access Control
Joomla! Core - 20260910 - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents...
PT-2026-102665
Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...
ROS-20260929-73-0068
The vulnerability of the smb2sesssetup function in the fs/smb/server/smb2pdu.c file of the Smb kernel of the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of protected information or cau...
CVE-2026-103042: Allocation of Resources Without Limits or Throttling
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
PT-2026-108601
Security vulnerability affects the langfuse package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...
QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...
NoMachine Local Privilege Escalation
NoMachine contains an external control of file path vulnerability that allows local attackers with low-privileged code execution to escalate privileges and execute arbitrary code as root...
CVE-2026-61519: Incorrect Authorization
Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...
PT-2026-102817
Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...
ROS-20260929-73-0100
The vulnerability of the privcmdinit function in the drivers/xen/privcmd.c module of the Linux kernel is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...
PT-2026-102663
Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host versions prior to 15.82 Description An improper access control weakness in the software allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By...
CVE-2026-102568: Incorrect Authorization
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog
Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...