120672 matches found
CVE-2026-70229
Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-70148
Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally...
CVE-2026-70083
Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally...
CVE-2026-70057
Incorrect authorization in Windows Routing and Remote Access Service RRAS allows an authorized attacker to bypass a security feature locally...
CVE-2026-69640
Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network...
CVE-2026-110238
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUse...
CVE-2026-110230
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...
CVE-2026-110218
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish...
CVE-2026-110211
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/namespace/slug. Attackers can locate targets through the anonymous search endpoint and trigger deletion without...
CVE-2026-110216
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...
CVE-2026-110215
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/roleId/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role,...
CVE-2026-110207
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin...
CVE-2026-110208
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...
CVE-2026-110209
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config...
CVE-2026-110210
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...
CVE-2026-104875
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...
CVE-2026-103560
Improper authorization in DNS Server allows an authorized attacker to perform tampering locally...
CVE-2026-102865
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...