CVE-2026-64948

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...

EUVD-2026-90597

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...

CVE-2026-64948: Authorization Bypass Through User-Controlled Key

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...

CVE-2026-48826 HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group i...

CVE-2025-71420

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...

CVE-2025-71420 UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...

CVE-2025-71420

UVdesk core-framework before 1.1.7 contains an authorization bypass in the saved reply endpoint. Agents holding the ROLE_AGENT permission can enumerate saved reply identifiers and read reply content restricted to other support groups or teams, resulting in a low confidentiality impact (CVSS 3.1 b...

CVE-2026-19629

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

CVE-2026-19629 Privilege Escalation

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

CVE-2026-19629

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

EUVD-2026-58732

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

CVE-2026-19629 Privilege Escalation

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

CVE-2026-19629

CVE-2026-19629 describes a privilege-escalation in Tenable Security Center where a user with the Security Manager role and “manage user” permission on a single group can modify users in other groups, bypassing cross-group access controls. The issue affects the Security Center component and is cla...

PT-2026-72057

Name of the Vulnerable Software and Affected Versions Tenable Security Center affected versions not specified Description A privilege escalation issue allows a user assigned the Security Manager role with the manage user permission for a specific group to modify users in different groups. This fl...

CVE-2026-19629: Incorrect Authorization

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

CVE-2026-65316

XXL-Job version 2.4.2 is affected by an insecure direct object reference in the logDetailCat endpoint, enabling authenticated users to read execution logs from job groups they’re not authorized to access by supplying arbitrary sequential logId values. This allows cross-group disclosure of potenti...

CVE-2026-65316 xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

CVE-2026-6341 Incomplete group locking implementation

Mattermost Plugins versions =11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to which allows a user that is member of multiple groups to create issues to a locked group via direct API requests. Mattermost Advisory ID:...

Mattermost Plugins 安全漏洞

Mattermost Plugins is a plugin provided by the American company Mattermost, offering powerful feature extensions and tight integration with servers and network/desktop applications. Versions 11.5, 11.1.5, 10.13.11, and 11.3.4.0 of Mattermost Plugins contain security vulnerabilities. These...

WordPress BuddyTask plugin <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation vulnerability

Missing Authorization to Authenticated Subscriber+ Cross-Group Task Board Access and Manipulation vulnerability discovered by Itthidej Aramsri Boeing777 in WordPress Plugin BuddyTask versions = 1.3.0...