248733 matches found
CVE-2026-49302
A vulnerability (CVE-2026-49302) with a permission control issue in the notification service module could affect service confidentiality if exploited locally with low complexity and no user interaction (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; base score 6.2). The description does not provi...
CVE-2026-49302
Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
EUVD-2026-60070
Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49307
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
EUVD-2026-60067
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49307
CVE-2026-49307 describes a permission control vulnerability in the device’s multi-mode input module, affecting confidentiality. CVSS 3.1 base score 6.2 (MEDIUM); attack vector LOCAL, complexity LOW, privileges NONE, user interaction NONE, scope UNCHANGED, with confidentiality impact HIGH. There a...
CVE-2026-49307
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49307
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
Improper Access Control
org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an improper access control. The vulnerability is due to an inverted IP address validation check that rejects legitimate requests from the bound IP address while allowing requests from other IP addresses, which allows an attacker to bypass...
MINI-5XRG-PFX6-3QQQ
Bulletin has no description...
MINI-8RWC-MPC5-VH33
Bulletin has no description...
MINI-XH34-53RP-9J9Q
Bulletin has no description...
MINI-QRJ5-QC32-6GQ5
Bulletin has no description...
MINI-VFQ3-MHP9-GRPF
Bulletin has no description...
BIT-GITLAB-2026-4672 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...
BIT-RCLONE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
BIT-NODE-MIN-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...
BIT-NODE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...
BIT-MONGODB-2026-13061 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
BIT-MONGODB-2026-13057 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META
An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...