Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch

Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin...

Adobe Commerce/Magento - Customer Session Identity Switch

Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction. id: CVE-2026-71362 info: name: Adobe Commerce/Magento - Customer Session Identity Switch...

CVE-2026-54998-exp

免责声明 本仓库仅用于教育和研究目的。 作者不对因使用本材料而造成的任何滥用、损害或非法活动负责。 请自行承担使用风险。 遵守适用的法律和道德准则。 概述 CVE-2026-54998 是 Microsoft Exchange Online 中的一个不正确的授权 （Incorrect Authorization，CWE-863）漏洞。它允许具有低级别用户权限的已认证攻击者通过网络将其访问权限提升到预期授权范围之外。 该漏洞于 2026 年 7 月 3 日发布。CVSS v3.1 评分：8.8（高危） 。 受影响版本 Microsoft Exchange Online（2026 年 7 月...

gitea-CVE-2026-28699

CVE-2026-28699: HTTP Basic Auth के माध्यम से Gitea OAuth2 Scope Bypass जब एक Gitea OAuth2 एक्सेस टोकन, जो केवल read:user तक सीमित है, को Bearer टोकन के बजाय Authorization: Basic base64:x-oauth-basic के रूप में भेजा जाता है, तो वह पूर्ण लेखन क्रियाएँ कर सकता है। Basic auth के माध्यम से प्रस्तुत कि...

CVE-2022-0482_exploit

Ausnutzung der Schwachstelle CVE-2022-0482 Einleitung Dieses Dokument beschreibt die detaillierte Analyse von CVE-2022-0482, einer kritischen Sicherheitsschwachstelle in der Terminplanungssoftware Easy!Appointments. Dieser Fehler, der unter CWE-863 als fehlerhafte Autorisierung eingestuft wird,...

Security Bulletin: This Power System update is being released to address CVE-2026-17063

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-17429

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted...

CVE-2026-70763

Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite component: Daily Business Intelligence. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2026-70729

Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite component: Service Request Form. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Teleservice...

Exploit for CVE-2026-71362

CVE-2026-71362 — Magento / Adobe Commerce customer-session ide...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Jackson Data Binding, Jackson Core, Postgresql, Scram Client, Apache MINA SSHD, Jansi Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

CVE-2026-72673

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...

CVE-2026-72630

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72630

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

EUVD-2026-58290

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72630

CVE-2026-72630 affects Kibana Fleet with Incorrect Authorization (CWE-863) causing privilege escalation (CAPEC-122). Root cause: during updates, Fleet validates the integration policy restriction against the stored policy’s integration instead of the replacement integration, allowing a user with ...

CVE-2026-72630 Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72673

Summary: Kibana Synthetics private locations across multiple spaces are vulnerable to unauthorized deletion due to Incorrect Authorization (CWE-863). The ACL check only considered monitors in the requesting user’s own space, allowing a user with Synthetics write privilege in one space to delete a...

CVE-2026-72673

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...