1319479 matches found
BIT-DISCOURSE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...
CVE-2026-64948 Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...
CVE-2026-64948 Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...
CVE-2026-64948
Pandora FMS version 777 and onwards is vulnerable to an authorization bypass in the module data retrieval process. Specifically, missing authorization in the get_module_detail AJAX endpoint allows for unauthorized cross-group access to module history. This flaw enables a user to view history data...
BIT-KIBANA-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...
BIT-DOTNET-SDK-2026-69806 .NET Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...
BIT-DOTNET-2026-69806 .NET Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...
BIT-ELK-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...
BIT-AUTHENTIK-2026-94611 authentik: Stored credentials are readable with view permission alone
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...
CVE-2026-103659
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
CVE-2026-103659
MISP versions prior to 2.5.48 are vulnerable to an authorization bypass within the event flattening feature. When a user requests an event with the flatten option enabled, the application removes Object containment from the query and returns object attributes as top-level attributes without re-ap...
CVE-2026-103659 MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
EUVD-2026-90575
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In doing so, the object-level distributi...
CLEANSTART-2025-PN80163 Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability
Security vulnerability affects the exim package. Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability...
CLEANSTART-2025-DX69052 Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability
Security vulnerability affects the exim package. Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability...
Unauthenticated Arbitrary File Disclosure
org.apache.wicket, wicket-core is vulnerable to an unauthenticated arbitrary file disclosure. The vulnerability is due to improper validation of attacker-controlled locale, style, and variation URL attributes before they are appended to the resource path, which allows an attacker to use path...