78125 matches found
[SECURITY] Fedora 43 Update: freeipa-4.13.2-1.fc43
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...
EUVD-2026-54322
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54314
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54321
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54171
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...
EUVD-2026-54207
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely...
EUVD-2026-54220
A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file viewstudents.php. Such manipulation of the argument classgroup leads to authorization bypass. The attack may be launched remotely...
CVE-2026-65667
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-62830
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
CVE-2026-59118
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network...
PT-2026-76578
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp read trailer and merges them into request headers. The fix introduces evhttp parse headers impl and a temporary trailer header list. An unauthenticated...
CVE-2026-62830
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
CVE-2026-65667
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-59118
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-67621
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...
CVE-2026-48077
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...
CVE-2026-45415
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csvcensus/censuslogs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatu...
CVE-2026-19064
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely...
CVE-2026-19066
A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file viewstudents.php. Such manipulation of the argument classgroup leads to authorization bypass. The attack may be launched remotely...