229783 matches found
PT-2026-71440
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...
PT-2026-71760
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...
PT-2026-71439
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...
PT-2026-71588
Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...
ROS-20260813-73-0025
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0015
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0029
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
PT-2026-71491
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...
ROS-20260813-73-0010
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0012
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0035
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0023
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0042
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
PT-2026-71652
Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x Description An access control bypass exists that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup f...
PT-2026-71718
Name of the Vulnerable Software and Affected Versions Rainbond versions prior to 6.9.8 Description Broken access control exists in the CheckToken function. Authenticated attackers can access unauthorized enterprise resources by substituting another enterprise's tenant name within URL paths. By...
PT-2026-71701
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting, which is intended to control whether repository administrators...
PT-2026-71554
Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...
PT-2026-71790
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
PT-2026-71629
Name of the Vulnerable Software and Affected Versions rsync daemon versions prior to 3.5.0 Description An IP address spoofing issue exists that allows unauthenticated remote attackers to bypass IP-based access controls. By sending a crafted PROXY protocol header containing a forged source address...