DRUPAL-CONTRIB-2026-194

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

CVE-2026-76455

The Cisco NX-OS Software is affected by multiple vulnerabilities categorized as Improper Access Control (CWE-284). These issues were identified during an internal security review and are addressed in the October 2026 Software Security Hardening Release . The vulnerabilities are assigned a CRITICA...

CVE-2026-76455 Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-76455 Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

EUVD-2026-94460

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2025-67223

CVE-2025-67223: Неверный контроль доступа и раскрытие информации в Aranda Service Desk CVE ID: CVE-2025-67223 Затронутый продукт: Aranda Service Desk модуль Aranda File Server - AFS Затронутые версии: 8.3.12 Автор: Brandon Perez Lara 🚨 Обзор Критическая уязвимость была обнаружена в модуле...

CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205

Versions of LMCache through 0.5.5 are vulnerable to a missing authentication flaw in the multiprocess coordinator. The vulnerability allows remote unauthenticated attackers to access the HTTP fleet control API, which listens on all interfaces by default. Exploitation of these endpoints enables at...

EUVD-2026-94384

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2024-24409

CVE-2024-24409 - ADManager Plus Build 7210 Уязвимость повышения привилегий Описание «Modify Computers» — это предопределённая роль в ADManager для управления компьютерами. Если у технического пользователя есть привилегия «Modify Computers» на компьютере, он может изменять атрибуты...

CVE-2025-39247

CVE-2025-39247 Цель: HikCentral Professional HCMP, центральный сервер VMS CVE: CVE-2025-39247 — Уязвимость контроля доступа CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Затрагиваемые версии: V2.3.1 – V2.6.2 и V3.0.0 Исправлено в: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 Раскрыто: 2025-08-28...

CVE-2026-105267

A flaw was found in Gitea. The web endpoint used for deleting repository tags shares request handling logic with release deletion without verifying if the target is an ordinary tag. An authenticated collaborator with code write permissions can exploit this flaw to bypass release access controls a...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update

Red Hat JBoss Web Server 7.0.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

bpfjailer

BpfJailer Мандатный контроль доступа для Linux на основе eBPF. Этот проект представляет собой полную переработку закрытого исходного кода BpfJailer и является полностью экспериментальным. Он использует новые возможности, такие как bpf arena, которые были недоступны при написании внутренней версии...

WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme DK versions = 3.2.1...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...