CVE-2026-48412

Summary: CVE-2026-48412 affects Adobe Commerce and describes an Incorrect Authorization vulnerability that could enable privilege escalation. An attacker with high privileges could exploit it to gain elevated access to restricted resources, and exploitation does not require user interaction. The ...

CVE-2026-71362

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...

CVE-2026-69278

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-62915

Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network...

CVE-2026-62872

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network...

CVE-2026-62775

Incorrect authorization in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to disclose information locally...

CVE-2026-58650

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-58650

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-47704

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...

CVE-2026-40375

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network...

CVE-2026-58639

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-56659

Incorrect authorization in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to disclose information locally...

EUVD-2026-56562

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

EUVD-2026-56289

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-58650

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-71383 ColdFusion | Incorrect Authorization (CWE-863)

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this...

CVE-2026-48375

The CVE-2026-48375 entry concerns Adobe ColdFusion with an Incorrect Authorization (CWE-863) vulnerability that can crash the application, causing a denial-of-service. According to provided details, a low-privileged attacker over the network can exploit this without user interaction to trigger a ...

CVE-2026-25652

CVE-2026-25652 is an Incorrect Authorization vulnerability affecting Adobe ColdFusion (per APSB26-90). The issue allows a low-privileged attacker with local access to escalate privileges and perform unauthorized read and write actions. Exploitation does not require user interaction. The CVSS-like...

CVE-2026-47704 TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session

TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized typebotId and blockId and a foreign live resultId. The webhook resume handler...