EUVD-2026-22931

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the admin or power Splunk roles, has write permission on...

CVE-2026-33214 Weblate has improper access control for the translation memory API

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue b...

CVE-2026-20203

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the admin or power Splunk roles, has write permission on...

CVE-2026-20161

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are on the local file syst...

CVE-2026-20203

CVE-2026-20203 describes improper access control in Data Model Acceleration for Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127. A low-privilege user ...

Cisco ThousandEyes Enterprise Agent 安全漏洞

Cisco ThousandEyes Enterprise Agent is an application developed by Cisco, a US-based company. It provides extended visibility, automated insights, and seamless workflows. There is a security vulnerability in Cisco ThousandEyes Enterprise Agent, which stems from improper access control in the loca...

Slah CMS 安全漏洞

Slah CMS is a content management system developed by the Brazilian company Slah. Versions of Slah CMS prior to 1.5.0 contain security vulnerabilities. These vulnerabilities stem from improper access control in the config.php component, which may allow unverified attackers to access sensitive...

EUVD-2026-22595

Improper access control in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...

EUVD-2026-22428

Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally...

CVE-2026-27914

Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally...

CVE-2026-26183

Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally...

CVE-2026-32214

Improper access control in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...

CVE-2026-33103

Improper access control in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information locally...

Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability

Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally...

Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

Improper access control in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...

EUVD-2026-22095

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials. Affected Products: UniFi Play PowerAmp Version 1.0.35 and earlier UniFi Play Audio Port Version 1.0.24 and earlier Mitigation: Update UniFi Play...

EUVD-2026-22093

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system. Affected Products: UniFi Play PowerAmp Version 1.0.35 and earlier UniFi Play Audio Port Version 1.0.24 and earlier Mitigation:...

PT-2026-32863

Name of the Vulnerable Software and Affected Versions Windows Virtualization-Based Security VBS Enclave affected versions not specified Description Improper access control in the Virtualization-Based Security VBS Enclave allows an authorized attacker to bypass a security feature locally...

PT-2026-32857

CVE-2026-32214 Improper access control in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally. https://t.co/mQeTrH15sG...

Microsoft Dynamics 365 访问控制错误漏洞

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. It is used for financial management, production management and business intelligence management. An information disclosure vulnerability exists in Microsoft Dynamics 365 On-Premises,...