47303 matches found
EUVD-2026-73041
Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network...
CVE-2026-69717
CVE-2026-69717 is a privilege elevation vulnerability in Windows Group Policy caused by an untrusted pointer dereference . An authorized attacker with low privileges can exploit this over the network, with user interaction required, to gain high impact on confidentiality, integrity, and availabil...
CVE-2026-62895
Azure Arc SQL Server Extension is affected by a permissive cross-domain policy that permits untrusted domains, enabling an elevation of privilege over the network. The vulnerability requires user interaction and no prior privileges (CVSS 3.1: 8.8 HIGH , AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The r...
EUVD-2026-73168
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...
EEF-CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates
Summary AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned record...
CVE-2026-78216
AshLua (an Elixir library exposing Ash read actions to Lua scripts via an eval action) contains a field-policy bypass in its aggregate read operations (list, min, max, first, sum, avg). Ash field policies redact forbidden fields on returned records, but that redaction does not apply to aggregate ...
CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...
CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...
CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...
EUVD-2026-72931
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...
CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...
EEF-CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields
Summary AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing...
CVE-2026-78230
ash_ai (an Elixir/Erlang library exposing Ash resources to language-model tool calls) contains an authorization bypass in its read tool. The tool's aggregate result types (min, max, sum, avg ) build an ad-hoc Ash.Query.Aggregate over a named field and return its raw value, but Ash field policies ...
CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...
CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...
EUVD-2026-72924
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...
CVE-2026-73318
XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation...
firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...
