1908 matches found
EUVD-2026-72038
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible...
CVE-2026-86153
Tenda CP3 (firmware 27.5.57.101 ) is affected by an improper privilege management vulnerability in the function CRedirServer::SetRedirectEnable within the file Functions/Redirect.cpp . The flaw allows remote exploitation over the network with low complexity , though it requires high privileges (p...
CVE-2026-86153: Improper Privilege Management
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible...
PT-2026-86465
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible...
CVE-2026-18480: Improper Privilege Management
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...
CVE-2026-78362: Improper Privilege Management
The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site...
CVE-2026-85514
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...
CVE-2026-85514 StackStorm st2 API Key auth.py privileges management
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...
EUVD-2026-71088
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...
CVE-2026-85514 StackStorm st2 API Key auth.py privileges management
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...
CVE-2026-85514: Improper Privilege Management
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be...
CVE-2026-85513: Improper Privilege Management
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...
PT-2026-85522
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api key api.user leads to improper privilege management. The attack may be...
PT-2026-85521
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert user is admin if user query param is provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes imprope...
CVE-2026-85154: Improper Privilege Management
WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...
SUSE CVE-2026-84358
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-84358
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-84358
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-84358: Improper Privilege Management
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-84795: Improper Privilege Management
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...