229827 matches found
PT-2026-71518
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
PT-2026-71526
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
PT-2026-71799
Name of the Vulnerable Software and Affected Versions Signify Philips Hue Bridge Pro versions prior to 1.77.2071318010 Description The firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces with anonymous access enabled and no firewall restrictions. This allows an...
ROS-20260813-73-0006
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0018
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0037
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0030
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0027
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0043
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0033
The vulnerability in Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability can allow an attacker to cause service failures...
CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...
CVE-2026-49473
@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...
CVE-2026-47718
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...
CVE-2026-47718
CVE-2026-47718 (FUXA) affects the FUXA web-based SCADA/HMI with secureEnabled=true. In version 1.3.0-2773 , the token handling in server/api/jwt-helper.js (verifyToken) converts missing or invalid tokens into a guest context instead of rejecting the request, allowing unauthenticated or invalid-to...
CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18744
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — testfunc only checks ismycase, not ownership of kwargs'member'. Bypasses sharestatus; leaks embargoed vendor affected/not-affected + statement text cross-tenant...
CVE-2024-27253 IBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete request
IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities...
CVE-2024-27253
CVE-2024-27253 affects IBM Engineering Requirements Management DOORS Next, version 7.0.3 (including 7.0.3 Interim Fix 018). An authenticated user could bypass security logic and perform unauthorized activities. Remediation: upgrade to iFix019 or later for DOORS Next 7.0.3, or upgrade to the lates...
EUVD-2026-57642
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...
