Lucene search
+L

19858 matches found

NVD
NVD
added 2026/08/13 3:20 p.m.7 views

CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS0.00343EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/08/13 2:42 p.m.6 views

CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS5.4AI score0.00343EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 2026/08/13 2:42 p.m.44 views

CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS0.00343EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/13 2:42 p.m.34 views

CVE-2026-70463

CVE-2026-70463 affects rsync up to version 3.4.x (before 3.5.0) where the auth users parser incorrectly tokenizes the user list by comma, failing to correctly handle entries like @Group Name with spaces. This causes the deny rule for that group to be silently discarded during parsing, enabling an...

8.6CVSS5.4AI score0.00343EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/13 2:42 p.m.21 views

CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS5.5AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/13 12:00 a.m.7 views

PT-2026-71663

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

8.6CVSS5.3AI score0.00343EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/12 10:17 p.m.12 views

CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

5.3CVSS0.00237EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 9:09 p.m.26 views

CVE-2026-18750 CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

0.00237EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/12 6:17 p.m.9 views

CVE-2026-18244

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS0.00205EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 6:08 p.m.26 views

CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...

4.3CVSS0.00251EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/12 6:08 p.m.39 views

CVE-2026-73301

CVE-2026-73301 (Budibase) describes a missing RBAC check on GET /api/global/groups in Budibase prior to 3.39.25. An authenticated BASIC user could enumerate tenant groups, role mappings, and user memberships, effectively exposing the tenant access-control structure to non-builder/ non-admin users...

4.3CVSS5.3AI score0.00251EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/12 6:05 p.m.35 views

CVE-2026-18244

GitLab EE remediation: CVE-2026-18244 affects all GitLab EE versions 17.7–before 19.0.6, 19.1–before 19.1.4, and 19.2–before 19.2.2, where an authenticated user could view restricted group settings due to improper authorization checks on a group settings page. The CVSS 3.1 base score is 4.3 (Medi...

4.3CVSS5.3AI score0.00205EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/08/12 6:05 p.m.9 views

EUVD-2026-57391

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS5.3AI score0.00205EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/12 6:05 p.m.47 views

CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS0.00205EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/12 6:05 p.m.5 views

CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

4.3CVSS5.6AI score
SaveExploits0References5
The Hacker News
The Hacker News
added 2026/08/12 5:39 p.m.14 views

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The...

7CVSS7.8AI score0.00332EPSS
SaveExploits2
RedhatCVE
RedhatCVE
added 2026/08/12 9:35 a.m.8 views

CVE-2026-68450

A flaw was found in the Linux kernel's btrfs filesystem. When the addrelocroot function attempts to insert a duplicate mapping node into the relocroottree, the newly allocated node is not properly freed. This oversight can lead to a memory leak, potentially causing resource exhaustion and a Denia...

5.5CVSS5.4AI score0.00161EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/08/12 12:00 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2026-68272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate...

5.4AI score0.00175EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/11 7:18 p.m.11 views

CVE-2026-69115

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

7.1CVSS0.00238EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/11 6:21 p.m.28 views

CVE-2026-69115

OpenIM Server v3.8.3 is affected by a missing authorization vulnerability that lets any authenticated user access admin-only management endpoints. Specifically, POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups bypass an authverify.C...

7.1CVSS5.4AI score0.00238EPSS
SaveExploits0References5
Rows per page
Query Builder