277762 matches found
WordPress SMS Alert authorization issue vulnerability
WordPress SMS Alert 4.0.1 and earlier versions have a permission-related vulnerability. This vulnerability stems from the lack of authorization, which may lead to the exploitation of improperly configured access control levels...
Thorsten Rinne phpMyFAQ Permission and Access Control Vulnerabilities
Thorsten Rinne has discovered vulnerabilities related to permission licensing and access control in versions of phpMyFAQ prior to 4.1.9. This vulnerability arises from a lack of authorization in the deleteUser API. Non-superadmin users with deleteuser permissions can send DELETE requests to...
go-vikunja Vikunja permission granting and access control issues
The go-vikunja Vikunja 2.6.0 version has vulnerabilities related to permission management and access control. These vulnerabilities stem from improper access control in the getProjectAccessForUser function pkg/models/projectaccess.go. This function parses user project permissions as the maximum...
Thorsten Rinne phpMyFAQ Permission and Access Control Vulnerabilities
Thorsten Rinne’s phpMyFAQ versions prior to 4.2.0-alpha.2 and 4.2.0-beta contained vulnerabilities related to permissions and access control. These vulnerabilities stemmed from the group permission API’s updatePermissions and updateMembers endpoints, which did not consider language or category...
Thorsten Rinne phpMyFAQ Permission and Access Control Vulnerabilities
Thorsten Rinne has identified vulnerabilities related to permission handling and access control in versions of phpMyFAQ prior to 4.2.0-beta and 4.2.0-alpha. These vulnerabilities stem from improper permission verification in the GroupController::saveCategoryRestrictions function. Restricted...
Thorsten Rinne phpMyFAQ Permission and Access Control Vulnerabilities
Thorsten Rinne’s phpMyFAQ 4.2.0-alpha to 4.2.0-beta versions contained vulnerabilities related to permission checks and access control. These vulnerabilities stemmed from a flaw in GroupController::deleteGroup, which lacked authorization verification. No check was performed to determine the group...
Thorsten Rinne phpMyFAQ Permission and Access Control Vulnerabilities
Thorsten Rinne’s phpMyFAQ version 4.2.0-alpha.2 to 4.2.0-beta had a vulnerability related to permission licensing and access control. This vulnerability occurred because UserController::updateUserRights discarded the language-specific permission restrictions during the re-granting of permissions...
CVE-2026-68908 libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...
CVE-2026-68908
The libIEC61850 open-source implementation of IEC 61850 protocols (including MMS, GOOSE, Sampled Values, and R-Session) contains a vulnerability in versions prior to 1.6.2 . The Reporting_RCBWriteAccessHandler accepts an RptID exceeding 129 bytes during the report-control-block write path. Subseq...
CVE-2026-68908 libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...
CVE-2026-68908 libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes...
EUVD-2026-102898
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connectedpeer.topics without confirming that the peer previously subscribed to those topics. A...
CVE-2026-95859
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connectedpeer.topics without confirming that the peer previously subscribed to those topics. A...
CVE-2026-106705
ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...
CVE-2026-110287
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...
CVE-2026-110287
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...
EUVD-2026-102874
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...
CVE-2026-110287
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint...
CVE-2026-110287
An improper access control vulnerability in Devolutions Server 2026.3.8.0 and earlier versions allows an authenticated user with general Edit privileges, but lacking specific Edit asset permissions, to modify the asset contact password . This is achievable by sending a crafted direct request to t...
