Astra Linux – Vulnerability in libde265

There is an incorrect access control vulnerability in libde265 v1.0.8 due to a SEGV in slice.cc...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access control via malicious network traffic...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. In Redis 7.0, before version 7.0.12, extracting key names from a command and a list of arguments could, in some cases, trigger a heap overflow, leading to the reading of random heap memory, heap corruption, and potentially remote code...

WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin RepairBuddy versions = 4.1223...

WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

CVE-2026-74595

A flaw was found in the Linux kernel's fscrypt component. When setting an encryption policy on an idmapped mount, the fscryptioctlsetpolicy function incorrectly performs an owner check. This vulnerability can lead to legitimate users being denied access to set encryption policies, while...

CVE-2026-19200

Velociraptor 's verify() VQL function suffers from an implementation fault that causes it to use the global artifact repository instead of a scoped one. This allows a user with only the NOTEBOOK_EDIT permission (e.g., an analyst role) to overwrite existing live built-in artifacts without the perm...

CVE-2026-78204

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

oathkeeper

Chat · Discussioni · Newsletter · Documentazione · Prova Ory Network · Lavora con noi Ory Oathkeeper è un Identity & Access Proxy IAP e un'API per le decisioni di controllo degli accessi che autorizza le richieste HTTP sulla base di insiemi di regole di accesso. Segue il modello BeyondCorp...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204

Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...

EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

EUVD-2026-64678

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

CVE-2026-78203

Ghostwriter before 7.1.2 contains a cross-client authorization flaw in the report template swap endpoint . The endpoint fails to validate template ownership, and because template primary keys are sequential, an authenticated attacker can enumerate and attach templates belonging to other clients t...

PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

Cisco Catalyst SD-WAN Manager Information Disclosure (cisco-sa-sdwan-infodis-SPuJBDCe)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - An information disclosure vulnerability exists in the web-based management interface of Cisco Catalyst SD-WAN Manager due to insufficient access control enforcement for specific template types...

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and...

PT-2026-81045

Name of the Vulnerable Software and Affected Versions Style Kits versions prior to 2.6.6 Description Broken Access Control allows a user with Subscriber privileges to perform unauthorized actions. Recommendations Update Style Kits to version 2.6.6 or later...

PT-2026-80904

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...