606755 matches found
CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...
CVE-2026-78372
RansomLook is a ransomware group monitoring platform that fails to consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated remote attacker can access information associated with private entities through several web views and...
github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...
CVE-2026-78370
CVE-2026-78370 is a CRITICAL (CVSS 4.0: 9.2) authorization flaw in RansomLook , a ransomware intelligence platform. The legacy /export/ endpoint allowed unauthenticated remote users to export internal databases without consistently enforcing private-entity access restrictions, potentially disclos...
EUVD-2026-64843
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...
AppEngine vulnerability affects SICK ICR890-4 and SICK InspectorP6xx devices
Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK ICR890-4 and SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the device...
CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook
RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...
CVE-2026-78369
RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. Although this endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attac...
CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook
RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...
EUVD-2026-64840
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...
CVE-2026-21756
HCL Hive is affected by a broken access control vulnerability that could allow an authenticated or unauthorized user to introduce unverified, malicious, or broken code directly into production environments . The CVSS 3.1 score is 7.2 (HIGH) , with a vector requiring high privileges (PR:H), networ...
CVE-2026-21756 HCL Hive is affected by a broken access control vulnerability
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...
EUVD-2026-64839
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...
CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...
ConditionalAccessDocumentation
Documentare l'Accesso Condizionale con PowerShell Questo script PowerShell documenta le tue policy di Accesso Condizionale di Microsoft Entra. Lo script esporta tutti i dati in un file CSV che può essere formattato come un foglio di lavoro Excel. Per garantire che tutte le policy possano essere...
CVE-2026-78291
Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...
CVE-2026-78278
Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78272
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...