184452 matches found
CVE-2026-18886 Unauthenticated Privilege Escalation via System Configuration Image Upload Processor
ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...
CVE-2026-64896
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...
SUSE CVE-2026-62249
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...
Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by vulnerabilities
Summary IBM Java 17 is used by IBM Sterling Connect:Direct for UNIX in product configuration and data transmission. IBM Sterling Connect:Direct for UNIX is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct for UNIX has upgraded IBM Java 17 to address the issues CVE-2026-3428...
EUVD-2026-67143
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...
CVE-2026-64896
Johnson Controls T2000 (before 31.6 ) is affected by a Debug and Test Interface with Improper Access Control vulnerability, described as an open debug port that allows an attacker to access functionality not properly constrained by ACLs. The CNA-assigned CVSS 4.0 score is 5.2 (MEDIUM) with a phys...
EUVD-2026-67140
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...
CVE-2026-64896 T2000 open debug port
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...
EUVD-2026-67127
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81819 Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81658
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
CVE-2026-18504
A flaw was found in fastify. A remote attacker can bypass schema validation when a request body schema targets a root primitive value. This occurs because the validation process may coerce a JSON string into an expected type, but the original unvalidated string is then passed to the application...
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...
CVE-2026-17562
CVE-2026-17562 is an IDOR (Insecure Direct Object Reference) vulnerability in Summit Security Systems AdisyonPro prior to v5.21.0 . The root cause is an authorization bypass through a user-controlled key , allowing attackers to access functionality that is not properly constrained by ACLs. The vu...
CVE-2026-17562 IDOR in Zirve Security's AdisyonPro
Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0...
CVE-2026-81274
Subscriber Broken Access Control in Ditty = 3.1.67 versions...