Lucene search
+L

19862 matches found

ATTACKERKB
ATTACKERKB
added 2026/08/14 5:04 p.m.7 views

CVE-2026-19629

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

5.4AI score0.00389EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/14 5:04 p.m.27 views

CVE-2026-19629 Privilege Escalation

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

8.6CVSS0.00389EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/14 5:04 p.m.46 views

CVE-2026-19629

CVE-2026-19629 describes a privilege-escalation in Tenable Security Center where a user with the Security Manager role and “manage user” permission on a single group can modify users in other groups, bypassing cross-group access controls. The issue affects the Security Center component and is cla...

8.6CVSS5.3AI score0.00389EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2026/08/14 12:00 a.m.9 views

PT-2026-72057

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized...

8.1CVSS5.3AI score0.00389EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/13 3:20 p.m.7 views

CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS0.00343EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/08/13 2:42 p.m.6 views

CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS5.4AI score0.00343EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2026/08/13 2:42 p.m.34 views

CVE-2026-70463

CVE-2026-70463 affects rsync up to version 3.4.x (before 3.5.0) where the auth users parser incorrectly tokenizes the user list by comma, failing to correctly handle entries like @Group Name with spaces. This causes the deny rule for that group to be silently discarded during parsing, enabling an...

8.6CVSS5.4AI score0.00343EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/13 2:42 p.m.45 views

CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS0.00343EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/13 2:42 p.m.21 views

CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS5.5AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/13 12:00 a.m.7 views

PT-2026-71663

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x Description An authorization bypass exists in the parsing of the auth users directive. The parser utilizes comma-only tokenization when splitting the user list, which fails to correctly process entries...

9.1CVSS5.3AI score0.00509EPSS
SaveExploits0References87
NVD
NVD
added 2026/08/12 10:17 p.m.12 views

CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

5.3CVSS0.00237EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 9:09 p.m.26 views

CVE-2026-18750 CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

0.00237EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/12 6:17 p.m.9 views

CVE-2026-18244

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS0.00205EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 6:08 p.m.26 views

CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...

4.3CVSS0.00251EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/12 6:08 p.m.39 views

CVE-2026-73301

CVE-2026-73301 (Budibase) describes a missing RBAC check on GET /api/global/groups in Budibase prior to 3.39.25. An authenticated BASIC user could enumerate tenant groups, role mappings, and user memberships, effectively exposing the tenant access-control structure to non-builder/ non-admin users...

4.3CVSS5.3AI score0.00251EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/12 6:05 p.m.35 views

CVE-2026-18244

GitLab EE remediation: CVE-2026-18244 affects all GitLab EE versions 17.7–before 19.0.6, 19.1–before 19.1.4, and 19.2–before 19.2.2, where an authenticated user could view restricted group settings due to improper authorization checks on a group settings page. The CVSS 3.1 base score is 4.3 (Medi...

4.3CVSS5.3AI score0.00205EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/08/12 6:05 p.m.9 views

EUVD-2026-57391

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS5.3AI score0.00205EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 6:05 p.m.48 views

CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS0.00205EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/12 6:05 p.m.6 views

CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS5.6AI score
SaveExploits0References5
The Hacker News
The Hacker News
added 2026/08/12 5:39 p.m.14 views

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The...

7CVSS7.8AI score0.00332EPSS
SaveExploits3
Rows per page
Query Builder