592266 matches found
CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
EUVD-2026-55242
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
CVE-2026-72564
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
CVE-2026-72564
CVE-2026-72564 affects fosrl/pangolin (through v1.20.0). An improper authorization flaw allows an authenticated attacker to reuse an access token scoped to one resource to authenticate to a different resource in another organization. The server handler authWithAccessToken.ts calls verifyResourceA...
EUVD-2026-55257
GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...
CVE-2026-66915
Joomla Extension - fabrikar.com - Remote code execution in Fabrik 4.6.9 - An unauthenticated attacker could execute arbitrary code by using the ajaxcalc feature of the calc plugin...
CVE-2026-19404
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
EUVD-2026-55159
Joomla Extension - fabrikar.com - Remote code execution in Fabrik 4.6.7 - An unauthenticated attacker could execute arbitrary code by using the ajaxcalc feature of the calc plugin...
CVE-2026-66915
CVE-2026-66915 concerns Joomla extension Fabrik prior to version 4.6.7. An unauthenticated attacker can achieve remote code execution via the ajax_calc feature in the calc plugin. The provided documents do not include explicit exploitation status or a confirmed remediation step; no patch/version ...
CVE-2026-19404
This CVE (CVE-2026-19404) affects 389 Directory Server (389-ds-base). The flaw lies in the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations, which perform no authorization check. As a result, an unauthenticated remote attacker (or any authenticated low-privilege user ...
EUVD-2026-55158
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
CVE-2026-19404
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
CVE-2026-19404
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
CVE-2026-66409
DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot...
CVE-2026-66408
The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account...
CVE-2026-21084
Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
CVE-2026-21081
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...