121609 matches found
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the wolfSSL backend during the TLS handshake process. An attacker can cause improper authorization of an invalid key by presenting a specially crafted certificate with a manipulated validity length...
Exploit for Improper Authorization in Microsoft
certighost – NXC module for CVE-2026-54121 NetExec NXC...
CVE-2026-107431
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
CVE-2026-85298 Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...
EUVD-2026-100986
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
CVE-2026-14851
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...
BIT-KIBANA-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...
BIT-KIBANA-2026-102410 Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the...
BIT-KIBANA-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...
BIT-ELK-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...
BIT-ELK-2026-102410 Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the...
BIT-ELK-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...
BIT-ELASTICSEARCH-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
WordPress Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Kuba in WordPress Plugin Jeg Kit for Elementor versions = 3.2.19...
EUVD-2026-100940
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...
CVE-2026-110227
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...
CVE-2026-103907
The JNews - Jeg Elementor Kit plugin for WordPress (versions up to and including 3.2.19 ) is vulnerable to unauthorized sensitive information exposure due to a missing capability check on the jkit_post_block and jeg_find_author AJAX actions. The wp_ajax_jkit_post_block handler returns the full op...
CVE-2026-103907 Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkitpostblock' and 'jegfindauthor' AJAX actions in versions up to, and including, 3.2.19. The 'wpajaxjkitpostblock' handler registered generically for eve...
EUVD-2026-100896
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2...
EUVD-2026-100883
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...