19879 matches found
CVE-2026-85543
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces...
CVE-2026-85545
There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...
EUVD-2026-75401
There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...
CVE-2026-85545
There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...
CVE-2026-85545
HikCentral Access Control is affected by a broken access control vulnerability in some unspecified versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access, representing an authorization bypass. The vulnerability is exploitable over the net...
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
ImpactThe only authorization gate on the duplicate flow is PageAdmin.hasaddpermission,which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “maythis user create a page at all”. Nothing checks the user’s relationship to the page beingcopied:- cms/admin/forms.py —...
PYSEC-2026-3939 Wagtail: Improper restriction handling on Pages admin API
Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...
PYSEC-2026-3821 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...
PYSEC-2026-3813 ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...
ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...
sherlock v0.16.2
Hunt down social media accounts by username across 400+ social networks Installation • Usage • Contributing Installation !WARNING Packages for ParrotOS and Ubuntu 24.04, maintained by a third party, appear to be broken. Users of these systems should defer to uv/pipx/pip or Docker. Method| Notes...
EUVD-2026-75233
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...
EUVD-2026-75208
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
CVE-2026-84821: Missing Authorization
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
CVE-2026-81785: Missing Authorization
Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...
PT-2026-89439
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...
PT-2026-89370
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces...
PT-2026-89404
OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown...
PT-2026-89293
The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...