CVE-2026-33197

AMI APTIOV BIOS contains a vulnerability in the BDS Module (Secure Boot) where an incomplete list of disallowed inputs allows a privileged local user to bypass Secure Boot and achieve arbitrary code execution . The CVSS v4.0 score is 8.7 (HIGH) , with low attack complexity, high privileges requir...

Visual Studio Code Security Feature Bypass Vulnerability

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Windows Biometric Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...

Microsoft Exchange Server Tampering Vulnerability

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network...

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...

Azure Cosmos DB Spoofing Vulnerability

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally...

Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability

Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally...

CVE-2026-33391

Nozomi Networks Guardian/CMC contains an access control vulnerability in the Smart Polling configuration functionality, caused by insufficient validation of user privileges (incorrect authorization). An authenticated user with limited privileges can remotely bypass the web management interface's ...

CVE-2026-73317

XenForo before 2.3.13 contains a missing authorization flaw in the ACP cache-rebuild dispatcher . An administrator holding only the rebuildCache permission can supply an arbitrary job class and actor user ID in the POST body to invoke the approval queue job under any user identity, thereby approv...

CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

EUVD-2026-72754

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

CVE-2026-77654

Improper Privilege Management vulnerability in Horizon Security Analyzer formerly AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate their privileges by abusing the parameters of a command that ...

CVE-2026-77654

Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux 64-bit contains an Improper Privilege Management flaw affecting versions A33.10, A33.20, and A33.30 . The root cause is a misconfigured entry in the sudoers file : a local user with command-line access can escalate privileges...

PowerJob List - Authorization Bypass

PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges. id: CVE-2025-11580 info: name: PowerJob List - Authorization Bypass author: DhiyaneshDk severit...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

CVE-2026-77132

TYPO3 CMS is vulnerable to an information disclosure flaw in the backend localization wizard . Several AJAX routes used by this feature failed to perform authorization checks, allowing authenticated, low-privileged backend users to access information about records and content elements outside the...