2763 matches found
CVE-2025-64095---DNN-Unauthenticated-arbitrary-file-upload
CVE-2025-64095---DNN-Неаутентифицированная-произвольная-загрузка-файлов POC недостаточного контроля доступа DNN — загрузка изображений позволяет перезаписывать содержимое сайта Я простой человек: вижу cvss:10/10 — захожу xD Я увидел эту новую CVE-2025-64095: недостаточный контроль доступа DNN —...
CVE-2026-76488
A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...
DRUPAL-CONTRIB-2026-202
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...
EUVD-2026-94469
A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...
PT-2026-107744
Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...
PT-2026-107617
Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC affected versions not specified Description Insufficient access control to file system resources within the export policies functionality allows an authenticated remote attacker with...
PT-2026-107754
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...
Payload: Insufficient Access Control in Stripe REST Proxy
Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...
GHSA-R9V2-GG2J-22Q5 Payload: Insufficient Access Control in Stripe REST Proxy
Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...
CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
CVE-2026-105848
The @payloadcms/plugin-stripe component within the Payload headless content management system is vulnerable to insufficient access control in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . An authenticated user capable of reaching the enabled optional Stripe REST proxy can pe...
CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...
CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-
Уведомление о безопасности: недостаточный контроль доступа позволяет несанкционированно удалять комнаты Let's Chat Присвоенный CVE ID: CVE-2026-66751 Краткое описание DELETE /rooms/:room не выполняет никакой проверки авторизации, кроме требования входа в систему. Любая учётная запись может...
throttlestop-exploit-rw
Маппер физической памяти Исследовательский инструмент, демонстрирующий доступ к физической памяти через трансляцию виртуальных адресов в физические в сочетании с эксплуатацией уязвимого драйвера. Обзор Этот проект исследует низкоуровневое управление памятью Windows, объединяя технику superfetch д...
CVE-2021-21551
CVE-2021-21551 Уязвимость повышения привилегий драйвера Dell CVE-2021-21551 Описание Драйвер Dell dbutil23.sys содержит уязвимость недостаточного контроля доступа, которая может привести к повышению привилегий, отказу в обслуживании или раскрытию информации. Требуется доступ локального...
Rocky Linux 9 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlsa-2025_7043)
The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257043 advisory. microcodectl: Improper input validation in UEFI firmware CVE-2024-28047 microcodectl: Insufficient granularity of access control in UEFI firmware...
CVE-2026-12265
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...
CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...
CVE-2026-12265
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to an insufficient access control flaw in the HA failover endpoint . This vulnerability allows an attacker to perform destructive PostgreSQL database operations , potentially leading to complete data destruction. The vulnerabil...