191489 matches found
PT-2026-109460
Уязвимость сервера приложений Apache Tomcat связана с недостатками контроля доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти ограничения безопасности...
CVE-2026-65182: Improper Access Control
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...
Smb File System Heap Buffer Overflow DoS
The vulnerability of the smb2sesssetup function in the fs/smb/server/smb2pdu.c file of the Smb kernel of the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of protected information or cau...
Dotnetnuke < 10.3.3 Permission precedence flaw in module permissions (GHSA-hqgc-qj63-mx24)
According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A permission evaluation flaw could allow users with page-level content permissions to access module management features despite...
JetBrains TeamCity < 2020.1.5 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.5. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. CVE-2020-27628 - In JetBrains TeamCity before 2020.1.5, secure dependen...
JetBrains TeamCity < 2020.1.1 (CVE-2020-15828)
The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.1. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions. CVE-2020-15828 Note that Nessus has not...
JetBrains TeamCity < 2019.2.1 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session. CVE-2020-11688 - In JetBrains TeamCity before...
CVE-2026-75465
The /api.php/user/getlist endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters t...
Improper Neutralization
Overview Affected versions of this package are vulnerable to Improper Neutralization through the CONNECT and PUBLISH encoding paths in MqttEncoder and MqttCodecUtil. An attacker can send MQTT fields containing NUL bytes or wildcard characters by supplying crafted client identifiers, usernames, wi...
CVE-2026-78266
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-32561
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
CVE-2026-27364
Subscriber Broken Access Control in Style Kits = 2.6.5 versions...
GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...
CVE-2026-78266
AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...
CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...
CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...