EUVD-2026-94928

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0...

CVE-2026-19083

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07...

CVE-2023-42791_CVE-2024-23666

Scripts de explotación de comprobaciones de autorización insuficientes en Fortimanager CVE-2024-23666 y carga de archivos sin restricciones CVE-2023-42791 Se proporcionan dos scripts de explotación que aprovechan estas vulnerabilidades: rce.py: Proporciona una reverse shell o añade un administrad...

CVE-2022-30114

Fastweb FastGate 'cmproxy' buffer overflow CVE-2022-30114 Introduction This script is a Proof of Concept PoC of CVE-2022-30114 and causes a reboot of Fastweb FastGate home routers, both GPON and VDSL2 version. CVE-2022-30114 is a heap-based buffer overflow in the 'cmproxy' executable, a program...

CVE-2025-29927

CVE-2025-29927 — Next.js middleware authorization bypass Summary: vulnerability in Next.js middleware allowing authorization bypass by spoofing the x-middleware-subrequest header. Table of Contents CVE-2025-29927 — Next.js middleware authorization bypass Table of Contents Gathering vulnerable hos...

CVE-2026-47100-Analysis-Lab

CVE-2026-47100 — FunnelKit / Funnel Builder for WooCommerce Checkout Stored XSS Lab Local Docker lab for reproducing CVE-2026-47100 in a safe, least-harm way. This lab compares a vulnerable FunnelKit version against a patched version and verifies the behavior using a harmless JavaScript...

CVE-2025-40602

CVE-2025-40602 CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console AMC of SonicWall Secure Mobile Access SMA 1000 series appliances. The vulnerability stems from insufficient authorization in the AMC, allowing authenticated remote attackers to escalate...

CVE-2025-40602

CVE-2025-40602 📌 Overview CVE-2025-40602 is a local privilege escalation vulnerability affecting SonicWall Secure Mobile Access SMA 1000 series appliances. The flaw exists in the Appliance Management Console AMC due to insufficient authorization checks , allowing an authenticated low-privileged...

EUVD-2026-94852

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07...

CVE-2026-19083 IDOR in AKIN Software's OctoCloud

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07...

CVE-2026-19083

The OctoCloud software developed by AKIN Software Computer Import-Export Industry and Trade Co. Ltd. is vulnerable to an authorization bypass (CWE-639) caused by a User-Controlled key vulnerability. This flaw allows an attacker to access functionality that is not properly constrained by Access Co...

CVE-2026-104660

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 (Windows) are vulnerable to a missing authorization flaw in its COM objects. The service registers COM classes without DCOM access or launch permissions and fails to use a security descriptor during CoInitializeSecurity, allowing local in...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

EUVD-2026-94833

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

EUVD-2026-94823

Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer 3.6.0,3.9.7 allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then...

CVE-2026-107503

Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer 3.6.0,3.9.7 allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

CVE-2026-71896

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-66082

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...