4775 matches found
CVE-2026-66064 goshs has ACL Bypass & Path Traversal
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...
EUVD-2026-50080
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...
CVE-2026-54719 goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...
CVE-2026-54719 goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...
DEBIAN-CVE-2026-61487
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...
CVE-2026-61487
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...
CVE-2026-61487
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...
EUVD-2026-49847
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...
CVE-2026-61487 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...
PT-2026-65464
Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Broker versions prior to 5.19.9 Apache ActiveMQ Broker versions 6.0.0 through 6.2.7 Apache ActiveMQ All versions prior to 5.19.9 Apache ActiveMQ All versions 6.0.0 through 6.2.7 Apache ActiveMQ versions prior to 5.19.9 Apache...
Samba AD authenticated LDAP access domain takeover
Description Samba AD stores internal database configuration in LDB special records such as @MODULES and @PARTITION. These records are not directory objects and should never be writable by a normal LDAP client. An authenticated low-privilege domain user can nevertheless modify them through LDAP. T...
[20260808] - Core - Improper ACL checks for batch copy actions
An improper access check allows unauthorized users to perform copy batch operations on uneditable items...
CVE-2026-47086
A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by minting a URLAUTH token through the GENURLAUTH command. This allows bypassing Access Control Lists ACLs, which are rules that control access to mailboxes. Consequently, an attacker could read mail from any...
CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot
In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...
CVE-2026-10681
In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...
CVE-2026-64391
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...
PT-2026-64615
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec function calls set info sec without performing a per-handle access check. This allows a client t...
CVE-2026-17039
A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...
PT-2026-64377
Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated users possessing the PUBLICLINK CREATE profile flag can trigger unauthorized decryption and persistent storage of any vault account password. This occurs due to missing AccountAcl chec...