CVE-2024-50657

CVE-2024-50657:Incorrect Access Control on Owncloud apk An issue in Owncloud android apk v.4.4.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method. Vulnerability Type Incorrect Access Control Vendor of...

CVE-2020-14965

CVE-2020-14965 ██╗ ██╗████████╗███╗ ███╗██╗ ██╗███╗ ██╗ ██╗███████╗ ██████╗████████╗██╗ ██████╗ ███╗ ██╗ ██║ ██║╚══██╔══╝████╗ ████║██║ ██║████╗ ██║ ██║██╔════╝██╔════╝╚══██╔══╝██║██╔═══██╗████╗ ██║ ███████║ ██║ ██╔████╔██║██║ ██║██╔██╗ ██║ ██║█████╗ ██║ ██║ ██║██║ ██║██╔██╗ ██║ ██╔══██║ ██║...

CVE-2023-27350-PoC

CVE-2023-27350 This PoC demonstrates how it’s possible to bypass authentication in PaperCut MF/NG versions starting from 8.0 up to, but not including, 20.1.7, 21.2.11, and 22.0.9. It allows interaction with the system without using valid login credentials. Shodan Prompts 1. http.html:"papercut" 2...

EUVD-2026-112503

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

EUVD-2026-112491

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create...

CVE-2025-29306

CVE-2025-29306 FOXCMS Content Management System Service Parameter Injection Vulnerability 1. Vulnerability Overview FoxCMS is a free, commercially available and open-source website management system built on PHP+MySQL architecture. FOXCMS Content Management System has a service parameter injectio...

Digisol-DG-GR1321-s-Improper-Access-Control-CVE-2024-4231

Digisol-DG-GR1321-s-Improper-Access-Control-CVE-2024-4231...

CVE-2023-49978

CVE-2023-49978 Customer Support System 1.0 - Incorrect Access Control Description : Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators. Vulnerable Product Version : Customer Support...

tomcat security update

1:9.0.121-1 - Resolves: RHEL-255793 tomcat: Security constraint bypass due to improper access control CVE-2026-65182 - Resolves: Local information disclosure via Unix domain socket TOCTOU race condition CVE-2026-65183 - Resolves: RHEL-271822 tomcat: Improper Input Validation allows HTTP/2...

PT-2026-132301

Name of the Vulnerable Software and Affected Versions Bulk Share : Location Sender version 2.1.0 Description Insecure permissions allow unauthorized attackers to invoke an exported component, enabling arbitrary data access and control over the internal data flow of the application. Recommendation...

CVE-2026-79589

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw. The vulnerability stems from the exposure of a UART debugging interface that lacks authentication, authorization, and access control functionality. An attacker with physical access can solder to and ...

CVE-2026-107032

Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

VulnCheck KEV: CVE-2023-42442

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

EUVD-2026-113345

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/projectid allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts ...

EUVD-2026-113344

SuperAGI v0.0.14 contains an improper access control vulnerability in getagentbylatestexecution in superagi/controllers/agentexecution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through...

CVE-2026-51902

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/projectid allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts ...

EUVD-2026-113166

Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

EUVD-2026-113168

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data...

CVE-2026-107036

The application Mission Control / AIMSICD (version 2026080501 ) is vulnerable to unauthorized access due to insecure permissions . This flaw allows an attacker to invoke an exported component , which directly impacts the application's tracker blocker mechanism . No specific remediation or exploit...

EUVD-2026-113174

Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...