CVE-2025-26523

CVE-2025-26523 affects the RupeeWeb trading platform. The vulnerability arises from insufficient authorization controls on certain API endpoints that perform add and delete operations, enabling an authenticated remote attacker to modify information belonging to other user accounts. Documented imp...

CVE-2025-26523 Insufficient Authorization Vulnerability in RupeeWeb trading platform

This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other...

Exploit for Relative Path Traversal in Fortinet Fortimanager

Fortimanager insufficient authorization checks CVE-2024-23666...

CVE-2025-20125 Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability

A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. This vulnerability is due to a lack of authorization in a specific API and improper validation o...

CVE-2025-20125 Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability

A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. This vulnerability is due to a lack of authorization in a specific API and improper validation o...

CVE-2024-1625

An Insecure Direct Object Reference IDOR vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails t...

CVE-2024-36130

An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance...

PT-2025-23468

Name of the Vulnerable Software and Affected Versions Qualcomm chipsets affected versions not specified Meta Quest 3 and 3S versions August 7, 2025 and earlier Samsung S23 affected versions not specified Description A flaw exists in the Qualcomm Adreno GPU firmware that allows unauthorized comman...

PT-2025-4255

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 7.0.24 Oracle VM VirtualBox versions prior to 7.1.6 Description The issue is related to insufficient authorization mechanisms in the Core component of Oracle VM VirtualBox. Exploitation of this issue can...

PT-2025-4276 · Oracle · Oracle Communications Order/Service Management

Name of the Vulnerable Software and Affected Versions: Oracle Communications Order and Service Management versions 7.4.0 through 7.5.0 Description: The issue is related to insufficient authorization procedures in the Security component of Oracle Communications Order and Service Management. This c...

PT-2025-4278 · Oracle · Oracle Application Express

Name of the Vulnerable Software and Affected Versions: Oracle Application Express versions 23.2 through 24.1 Description: The issue is related to insufficient authorization procedure in the General component of Oracle Application Express. It allows a low-privileged attacker with network access vi...

PT-2025-5369 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: A Local Code Execution issue exists due to a default setting in Windows, allowing access to the Command Prompt as a higher privileged user. This issue is related to insufficient authorizati...

PT-2025-5295 · Apple · Applemobilefileintegrity +4

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions 13.7.3 and earlier macOS Sequoia versions 15.3 and earlier macOS Sonoma versions 14.7.3 and earlier Description: A logic issue was addressed with improved checks, which could allow an application to modify protected par...

PT-2024-10245

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description The vulnerability in the MySQL Server product of Oracle MySQL, specifically in the InnoDB component, is related to...

CVE-2021-1482 Cisco SD-WAN vManage Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain access to sensitive information on an affected system. This vulnerability is due to insufficient authorization checks. An...

PT-2024-10484 · Drupal · Drupal Basic Http Authentication

Name of the Vulnerable Software and Affected Versions: Drupal Basic HTTP Authentication versions 7.X-1.0 through 7.X-1.3 Drupal Basic HTTP Authentication versions prior to 7.X-1.4 Description: The issue is related to insufficient authorization mechanisms in the Basic HTTP Authentication module of...

PT-2024-10173 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.0 through 17.4.5 GitLab CE/EE versions 17.5 through 17.5.3 GitLab CE/EE versions 17.6 through 17.6.1 Description: The issue is related to insufficient authorization procedures in the Public Project Handler component o...

CVE-2024-20441

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected REST API endpoint. An attacker could...

CVE-2024-20441 Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected REST API endpoint. An attacker could...

PT-2024-8625 · Cisco · Cisco Ndfc

Name of the Vulnerable Software and Affected Versions: Cisco NDFC affected versions not specified Description: A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This iss...