grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

CVE-2026-9728

CVE-2026-9728 is a time-of-check/time-of-use (TOCTOU) race condition in the Zephyr RTOS userspace mailbox subsystem. The syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validates msg->data/msg->size by reading them directly from live userspace memory, then forwards the o...

CVE-2025-67888

CVE-2025-67888 Control Web Panel = 0.9.8.1208 admin/index.php OSコマンドインジェクションの脆弱性 影響を受けるバージョン: バージョン 0.9.8.1208 およびそれ以前のバージョン。 脆弱性の説明: "key" GETパラメータを介して /admin/index.php に渡されるユーザー入力は（"api"...

CVE-2026-78372

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78370

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

CVE-2025-68833

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...

EUVD-2026-64895

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export...

CVE-2024-50945

CVE-2024-50945 説明 SimplCommerceは、レビューシステムにおける壊れたアクセス制御の脆弱性の影響を受け、購入していない製品に対してレビューを投稿することを許可しています。 検出方法 攻撃者は、レビュー送信エンドポイントにリクエストを送信し、EntityIdを購入していない製品のIDに変更することで、この脆弱性を検出できます。レビューが正常に投稿された場合、ウェブサイトが壊れたアクセス制御の脆弱性に対して脆弱であることが確認されます。 テスト済み 230310c8d7a0408569b292c5a805c459d47a1d8f commit リンク...

CVE-2026-78387

RansomLook has an authorization weakness in its web-based configuration editor at the /admin/config endpoint. The route requires an authenticated session but performs no explicit privilege or administrator authorization check , allowing any authenticated low-privileged user to write crafted value...

CVE-2025-68833 HCL Hive is affected by use of a cryptographic primitive with a risky implementation

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...

EUVD-2025-210762

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...

CVE-2025-68833

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control , which could allow an unauthenticated, remote attacker to gain unauthorized access to resources . The CVSS 3.1 score is 5.3 (Medium) , reflecting a network attack vector with low complexity, no privileges or...

CVE-2026-21756

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...

CVE-2026-76847

act (nektos/act) versions 0.2.81 through 0.2.89 are affected by a missing authorization flaw in the Artifacts V4 backend , which is started whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. Three compounding issues enable unauthenticated artifact access: (1) val...

EUVD-2026-64845

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

CVE-2026-78372

RansomLook is a ransomware group monitoring platform that fails to consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated remote attacker can access information associated with private entities through several web views and...

CVE-2026-78370

CVE-2026-78370 is a CRITICAL (CVSS 4.0: 9.2) authorization flaw in RansomLook , a ransomware intelligence platform. The legacy /export/ endpoint allowed unauthenticated remote users to export internal databases without consistently enforcing private-entity access restrictions, potentially disclos...

EUVD-2026-64840

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...