24 matches found
CVE-2026-58848
In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58848: Concurrent Execution using Shared Resource with Improper Synchronization
In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...
CVE-2026-70759
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion component: Server. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...
CVE-2026-75850: Missing Authorization
ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...
PT-2026-73378
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...
CVE-2026-53793: Improper Link Resolution Before File Access
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...
PT-2026-70321
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Improper Input Validation issue allows a low-privileged attacker to achieve privilege escalation, granting unauthorized read and write access. This...
CVE-2026-48390 Bridge | Incorrect Authorization (CWE-863)
Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Sco...
CVE-2026-48390: Incorrect Authorization
Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Sco...
PT-2026-65553
Name of the Vulnerable Software and Affected Versions Bridge affected versions not specified Description An Incorrect Authorization issue allows for privilege escalation, enabling an attacker to obtain unauthorized read and write access. Exploitation requires user interaction, specifically...
PT-2026-62630
Name of the Vulnerable Software and Affected Versions Oracle Enterprise Asset Management versions 12.2.3 through 12.2.15 Description An issue in the Work Definition component allows a low privileged attacker with network access via HTTPS to compromise the system. This can lead to unauthorized rea...
CVE-2026-48321 ColdFusion | Incorrect Authorization (CWE-863)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation...
CVE-2026-48321
Technical details are not publicly available in the provided documents; no affected products, versions, or remediation are specified. Monitor for updates.
CVE-2026-5422 Path Traversal in jupyter/jupyter
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the getospath function within jupyterserver/services/contents/fileio.py. The check uses startswithroot without appending a trailing path separator, allowing sibling...
CVE-2026-5189: Use of Hard-coded Credentials
CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitatio...
CVE-2025-61809 ColdFusion | Improper Input Validation (CWE-20)
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation o...
CVE-2023-44278: Improper Limitation of a Pathname to a Restricted Directory
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. A local high privileged attacker could potentially exploit this vulnerability, to gain unauthorized read and write access to the OS files stored on the server...
PT-2023-29185 · Dell · Dell Powerprotect Dd
Name of the Vulnerable Software and Affected Versions: Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 Dell PowerProtect DD version 6.2.1.110 Description: A path traversal vulnerability exist...