62677 matches found
CVE-2026-41920
CVE-2026-41920 concerns an Improper Access Control in Apache Traffic Server. Affected versions are 9.0.0–9.1.14 and 10.0.0–10.1.3. The issue is fixed in 9.1.15 and 10.1.4. The provided sources do not include explicit root cause details beyond the access-control context, nor estimates of exploitat...
CVE-2026-41920
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue...
CVE-2026-63235 Improper access control vulnerability
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...
CVE-2026-63235
CVE-2026-63235 affects Koollab LMS and describes an improper access control issue. An unauthenticated attacker can use the login kickout endpoint to forcibly terminate the session of any user by supplying that user’s email address, leading to a denial of service. The available sources confirm the...
EUVD-2026-50130
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...
CVE-2026-63235 Improper access control vulnerability
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...
PT-2026-65706
An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service...
CVE-2026-7362 Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user...
CVE-2026-7362
IBM Sterling B2B Integrator and IBM Sterling File Gateway are affected by CVE-2026-7362. A authenticated user could obtain sensitive information that should be accessible only to privileged users. Affected versions: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.1.0–6.2.1.1_2 and 6...
CVE-2026-7362 Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user...
BIT-KIBANA-2026-56146 Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure
Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...
Kibana 9.4.x < 9.4.3 Multiple Vulnerabilities (ESA-2026-54 / ESA-2026-58)
The version of Kibana installed on the remote host is 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-54 and ESA-2026-58 advisories. - Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics...
[20260808] - Core - Improper ACL checks for batch copy actions
An improper access check allows unauthorized users to perform copy batch operations on uneditable items...
EUVD-2026-49379
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...
CVE-2026-17568
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...
PT-2026-65096
A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permission classes=AllowAny, authentication classes= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from...
CVE-2026-17432 NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improp...
CVE-2026-58630
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-48606
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...