278186 matches found
CVE-2026-86556 An information disclosure vulnerability in ZTE U30 Air product
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information...
CVE-2026-86556
The ZTE U30 Air product is affected by an information disclosure vulnerability caused by improper permission control . Attackers can exploit this flaw to obtain relevant information from the device. The vulnerability has a CVSS 3.1 base score of 5.3 (Medium) . No specific details regarding the af...
CVE-2026-86556 An information disclosure vulnerability in ZTE U30 Air product
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information...
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
EUVD-2026-89483
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
[SECURITY] Fedora 45 Update: gnome-control-center-51.0-1.fc45
This package contains configuration utilities for the GNOME desktop, which allow to configure accessibility options, desktop fonts, keyboard and mouse properties, sound setup, desktop theme and background, user interface properties, screen resolution, and other settings...
CVE-2026-51867
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...
CVE-2026-102397: Missing Authorization
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...
CVE-2026-102375: Missing Authorization
Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14...
CVE-2026-97243: Missing Authorization
Subscriber Broken Access Control in AllAble Connector = 0.13.4 versions...
PT-2026-103177
Subscriber Broken Access Control in FormGent = 1.12.2 versions...
PT-2026-103258
Contributor Broken Access Control in The Events Calendar = 6.17.5 versions...
ROS-20260930-73-0080
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-89190: Improper Access Control
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...
CVE-2026-97239: Missing Authorization
Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...
ROS-20260930-73-0093
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-103202
Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...
CVE-2026-102146: External Control of File Name or Path
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...
CVE-2026-88797: Improper Access Control
The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...