85727 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the ATTACH DATABASE process. An attacker can overwrite arbitrary files on the filesystem by sending crafted SQL commands to the server, potentially leading to execution of malicious code or disruption of...
EUVD-2026-44074
Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network...
EUVD-2026-44043
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-55052
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-50451
Missing authentication for critical function in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...
CVE-2026-50444
Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network...
GHSA-QRH4-P6V4-MRFG Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Summary: When Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy, the concurrent map writes trigger Go's built-in race detector...
Missing Synchronization
Overview Affected versions of this package are vulnerable to Missing Synchronization in the AddDiff function when running in Diff mode, which writes to the shared responsesDiff map without synchronization. An attacker can cause the process to crash and become unavailable by sending multiple...
GHSA-2P5X-4JR6-X5JG FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
Summary Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user lowpriv created a customer with nombre = "=SUM1+1cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payloa...
CVE-2026-57969
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
CVE-2026-55144
Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally...
DEBIAN-CVE-2026-54432
Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting XSS. The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page...
DEBIAN-CVE-2026-54433
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting XSS via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message zero-click...
CVE-2026-50333
Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally...
CVE-2026-49174
Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...
CVE-2026-50333
CVE-2026-50333 affects Windows Spaceport.sys. The vulnerability is described as missing authentication for a critical function, enabling a locally authenticated attacker to escalate privileges. Affected component is Spaceport.sys; no specific product version, root cause detail, or remediation ver...
CVE-2026-58279
CVE-2026-58279 affects Azure CycleCloud. The issue is missing authorization that could allow an authorized attacker to elevate privileges over a network, with integrity impact high and CVSS v3.1 base score 6.5. The attack vector is network; privileges required are low and user interaction is none...
CVE-2026-57969
Technical details (affected versions, root cause, exploit vectors) are not publicly available in the provided documents. Monitor for updates from official sources and CVE records.
CVE-2026-56164
CVE-2026-56164 is a Microsoft SharePoint Server elevation-of-privilege vulnerability described as missing authentication for a critical function, enabling a remote attacker to elevate privileges over a network. Public advisories indicate widespread Office-related vulnerabilities, with SharePoint ...
