Linksys WAG200G authorization issue vulnerability

The Linksys WAG200G versions 1.01.06 and earlier contain an authorization issue vulnerability. This vulnerability stems from a weak password change mechanism, allowing attackers to change administrator passwords without providing the current password. As a result, authenticated administrators may...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Versions 7.7.1.0 through 8.8 of Dell PowerProtect Data Domain contain a vulnerability related to permission escalation and access control. This issue stems from improper validation of privilege drops, potentially allowing low-privilege attackers with remote access to escalate their privileges...

Highcharts cross-site scripting vulnerability

Highcharts versions 1.0.0 through 4.2.2 contain a cross-site scripting vulnerability. This stems from unvalidated searches of the chartConstructor property, which may allow attackers to copy malicious options into container properties or features via control panel configuration. When these are...

WordPress My auctions allegro authorization issue vulnerability

WordPress My Auctions Allegro versions 4.0.3 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control levels...

HCL BigFix AEX permission and access control issue vulnerability

The HCL BigFix AEX v13.0.0.1 version contains a security vulnerability stemming from unrestricted file uploads and improper access controls. This vulnerability may allow attackers to upload malicious or unauthorized files, thereby gaining direct access to or downloading sensitive uploaded content...

Samba input validation error vulnerability

A vulnerability related to input validation exists in Samba versions 4.25.0 through 4.25.1. This vulnerability stems from an access control bypass in the openat function within the vfscephrgw module. Authenticated users can exploit this by requesting files whose names do not match case, causing t...

CVE-2026-6647: WSO2: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for…

In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing...

CVE-2026-50542: Missing Authorization

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/id allow an authenticated user with any privileges to view the status and metadata of any layout, including...

Oracle Application Object Library Code Execution

The vulnerability in the Core component of the Oracle Application Object Library for Oracle E-Business Suite enterprise activity automation is related to flaws in the authentication process. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code and gain full contr...

Azure API Management Developer Portal Access Control Bypass

The vulnerability in the Azure API Management APIM Developer Portal for developers is related to access control flaws. Exploitation of this vulnerability could allow a remote attacker to bypass security restrictions and gain unauthorized access to protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-99192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bcmgenet: unshare the skb before writing the control block bcmgenet stores firstcb, lastcb and bytessent in the skb control block and reads them back on...

PT-2026-129167

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

Linux Distros Unpatched Vulnerability : CVE-2026-118318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security...

Vulnerability related to permission and access control issues in Amazon AWS SDK for pandas

Versions of the Amazon AWS SDK for pandas prior to 3.16.1 contain a permission and access control vulnerability. This vulnerability stems from the lack of ownership verification for default query results in the Athena module; it may allow remote attackers to read Athena query results from a...

celerystalk

celerystalk celerystalk helps you automate your network scanning/enumeration process with asynchronous jobs aka tasks while retaining full control of which tools you want to run. Interactive Demo: Bug Bounty Mode HackerOne Interactive Demo: Vulnerability Assessment / PenTest Mode Retired...

CVE-2026-118337

Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-118318

Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-118318

Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-118318

Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

Malware in csec-form-validatorr

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...