CVE-2019-19550

CVE-2019-19550 Description Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL. Important Dates Announcement to Vendor: 2019-12-02 Public...

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

CVE-2026-102159

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services...

EUVD-2026-93956

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services...

CVE-2026-102159 Security Advisory 0190

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services...

CVE-2026-102159

An access-control flaw in the CV-CUE backend allows an unauthenticated network attacker to access functionality intended exclusively for internal services. Exploitation of this vulnerability may result in the exposure of sensitive location information or the disruption of affected services . No s...

CVE-2026-102159 Security Advisory 0190

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services...

PT-2026-107145

Name of the Vulnerable Software and Affected Versions Arista CloudVision CUE versions prior to 2026.2.1 Description An access-control flaw in the CV-CUE backend allows an unauthenticated network attacker to access functionality intended only for internal services. This may lead to the exposure of...

Security Advisory 0190

Security Advisory 0190 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All of the CVEs covered in this advisory affect only CloudVision-CUE on-premises. CV-CUE is Arista’s Wi-Fi management service and, in on-premises...

CVE-2026-87149

This vulnerability affects Oracle Contract Lifecycle Management for Public Sector (component: Award/PO ) in Oracle E-Business Suite, versions 12.2.8 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit it with low complexity to achieve unauthorized access to critic...

Astra Linux – Vulnerability in Linux 5.10, Linux

A flaw in incorrect access control in the Linux kernel’s USB core subsystem was discovered in the way users attach USB devices. A local user could exploit this flaw to crash the system...

PT-2026-91147

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

CVE-2026-87047

Tanium Comply is affected by an improper access controls vulnerability, assigned CVSS 3.1 score of 6.3 (Medium) with a network attack vector, low complexity, and low required privileges, resulting in low impacts to confidentiality, integrity, and availability. The vulnerability has been addressed...

CVE-2026-69267

Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose information locally...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-178)

Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: Fixes should be...

CVE-2026-84672

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

PT-2026-84835

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

PT-2026-99140

Уязвимость сервиса управления проектами и задачами Shtab связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации...

EUVD-2026-42984

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...

CVE-2026-77701 WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...