CVE-2026-40968 Spring gRPC SecurityContext leaks across requests on authorization failure

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions:...

CVE-2026-40968 Spring gRPC SecurityContext leaks across requests on authorization failure

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions:...

EUVD-2023-25636

Malicious code in bioql PyPI...

CVE-2023-21468

Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission...

CVE-2023-21468

Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission...

CVE-2023-21468

Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission...

CVE-2023-21468

Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission...

CVE-2023-21468

CVE-2023-21468 involves an improper access-control issue in Samsung Telephony prior to SMR Apr-2023 Release 1. The vulnerability permits access to files with escalated permissions due to insufficient access restrictions in the Telephony component. Affected product scope is Samsung Mobile devices;...

CVE-2023-21468

Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission...

PT-2025-35661

Name of the Vulnerable Software and Affected Versions Telephony versions prior to SMR Apr-2023 Release 1 Description An improper access control issue exists in Telephony. This allows attackers to access files with escalated permission. Recommendations Update Telephony to SMR Apr-2023 Release 1 or...

CVE-2024-7387 Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build containe...

PT-2021-21422

Name of the Vulnerable Software and Affected Versions Huawei Smartphone affected versions not specified Description The issue allows for tampering with the kernel, which may lead to escalated permissions if successfully exploited. Recommendations At the moment, there is no information about a new...

PT-2021-21426

Name of the Vulnerable Software and Affected Versions Huawei Smartphone affected versions not specified Description The issue concerns a vulnerability that allows tampering with the kernel in Huawei Smartphones. Successful exploitation of this vulnerability may lead to escalated permissions...

CVE-2020-12690

A flaw was found in Keystone, where it inadvertently provided OAuth1 access tokens to every role assignment the creator had for a project, resulting in giving more permissions and escalated access in role assignments than intended. The greatest impact is on confidentiality...

CVE-2020-12689

A vulnerability was found in Keystone's EC2 credentials API. This flaw allows any user authenticated within a limited scope trust/OAuth/application credential to create an EC2 credential with escalated permissions, for example, obtaining an "admin" role, while the user is on a limited "viewer" ro...

UBUNTU-CVE-2020-12689

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope trust/oauth/application credential can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially...

Command injection

Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user’s permissions...

CVE-2019-1576

Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user’s permissions...

Nextcloud: User with read-only access to a share can gain write access to sub-folders in the share

user0 creates folders /test and /test/sub user0 creates file /test/sub/file.txt user0 shares folder /test with user1 with read+share permissions 17 user1 receives the folder /test and can read-download /test/sub/file.txt - good user1 creates a link share of /test/sub - it has permissions 1...

Command Injection

ansible is vulnerable to command injection. It is possible due to a lack of the returned facts validation, allowing a remote host running ansible or via escalated permissions to alter connection or interpreter settings by injecting malicious command through it...