Lucene search
+L

226562 matches found

RedhatCVE
RedhatCVE
added 2026/08/21 11:31 a.m.6 views

CVE-2026-70452

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees. Mitigation To mitigate this issue...

9.1CVSS5.3AI score0.00462EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/21 11:22 a.m.9 views

CVE-2026-77776 Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...

9.3CVSS5.6AI score
SaveExploits0References8
NVD
NVD
added 2026/08/21 11:17 a.m.9 views

CVE-2026-77768

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

7.1CVSS0.00243EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/21 11:17 a.m.9 views

CVE-2026-77767

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

8.7CVSS0.00361EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/21 11:05 a.m.13 views

EUVD-2026-63902

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

7.1CVSS5.5AI score0.00243EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/21 11:05 a.m.20 views

CVE-2026-77769

OpenPanel 's report.list tRPC procedure contained a cross-organization authorization bypass . The enforceAccess middleware verified membership for the supplied projectId, but the dashboardId parameter was never validated against that project. The underlying getReportsByDashboardId query selected ...

7.1CVSS5.4AI score0.00243EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/21 11:05 a.m.29 views

CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

8.7CVSS0.00361EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/21 11:05 a.m.25 views

CVE-2026-77767

Reconmap , a penetration-testing engagement management platform, has an unauthenticated information disclosure in its report preview endpoint. The PreviewReport action in ReportsController.cs is decorated with [AllowAnonymous], bypassing the API's fallback authorization policy that requires an au...

8.7CVSS5.5AI score0.00361EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/21 11:05 a.m.18 views

CVE-2026-77768

CVE-2026-77768 is an authorization bypass in OpenPanel , an open-source analytics platform. The report.get tRPC procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned the report directly via getReportById(), which performs a findUnique with no project scoping. The ...

7.1CVSS5.5AI score0.00243EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/21 11:05 a.m.33 views

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

7.1CVSS0.00243EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/21 11:05 a.m.12 views

EUVD-2026-63900

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

8.7CVSS5.5AI score0.00361EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/21 11:05 a.m.13 views

EUVD-2026-63901

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

7.1CVSS5.5AI score0.00243EPSS
SaveExploits0References5
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/21 9:25 a.m.10 views

Security Bulletin: Multiple vulnerabilities affect IBM License Metric Tool

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication...

9.8CVSS6.3AI score0.00482EPSS
SaveExploits1Affected Software1
NVD
NVD
added 2026/08/21 9:16 a.m.7 views

CVE-2026-66797

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

5.4CVSS0.0023EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/21 9:16 a.m.7 views

CVE-2026-62440

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

0.00132EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/21 9:16 a.m.9 views

CVE-2026-50222

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...

0.00132EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/21 9:14 a.m.9 views

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 (CVE-2025-53066, CVE-2025-53057)

Summary IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 is vulnerable to a Exposure of Sensitive Information, Improper Access Control attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-53066 DESCRIPTION: An unspecified vulnerability in Java SE...

7.5CVSS5.4AI score0.00647EPSS
SaveExploits0Affected Software1
EUVD
EUVD
added 2026/08/21 8:29 a.m.12 views

EUVD-2026-63846

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...

5.3AI score0.00132EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/21 8:23 a.m.14 views

CVE-2026-62440

An Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin allows cross-tenant manipulation of the Kubernetes cluster during node addition and removal operations. The flaw means that a tenant may be able to interfere with cluster node operations belonging to a...

5.2AI score0.00132EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 8:23 a.m.10 views

EUVD-2026-63835

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

5.2AI score0.00132EPSS
SaveExploits0References1
Rows per page
Query Builder