222803 matches found
CVE-2026-85395 UnoPim before 2.1.3 Missing Authorization on Integration Management Routes
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...
CVE-2026-85395
UnoPim before 2.1.3 is affected by a missing authorization vulnerability in the Bouncer middleware . The integration store, update, and key-generation routes were omitted from the ACL map, allowing any user with minimal admin privileges to bypass permission checks. An attacker can create OAuth AP...
CVE-2026-85390
Checkmate through 3.11.0 omits the isAllowed role guard middleware on its maintenance-window, notification, and check-deletion routes, allowing users with a read-only role to perform administrative actions. A low-privileged attacker with a valid user-role session can create arbitrary maintenance ...
CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...
CVE-2026-78593
Kibana 's Cribl integration contains an insufficiently validated configuration field that allows an authenticated user with Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template. This results in an Elasticsearch ingest pipeline being writt...
CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
CVE-2026-78583
CVE-2026-78583 is an Incorrect Authorization (CWE-863) vulnerability in Kibana 's Elastic Fleet feature. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents . An attacker holding Fl...
CVE-2026-78583 Incorrect Authorization in Kibana Leading to Privilege Escalation
Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...
EUVD-2026-70657
Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...
CVE-2026-78583 Incorrect Authorization in Kibana Leading to Privilege Escalation
Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...
EUVD-2026-66331
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...
CVE-2026-15431 HP Support Assistant – Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...
CVE-2026-15431 HP Support Assistant – Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...
CVE-2026-15431
HP Support Assistant versions prior to 9.53.2.0 contain a local privilege escalation vulnerability caused by insufficient access controls , allowing a local attacker with low privileges (and no user interaction) to compromise the confidentiality, integrity, and availability of the vulnerable syst...
EUVD-2026-70656
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...
CVE-2026-85028
CVE-2026-85028 affects the FPGA management tool installation component of AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4 . The root cause is the creation of a temporary file in a world-writable directory with insecure permissions. A local attacker with low privileges can place crafted...
EUVD-2026-70652
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...
CVE-2026-85028 Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...
CVE-2026-85028 Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...
