Lucene search
+L

20267 matches found

OSV
OSV
added 2026/07/24 9:13 p.m.13 views

GHSA-4QCJ-M5WP-JMF4 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

4.3CVSS5.9AI score0.00315EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/24 1:57 p.m.41 views

CVE-2026-12503 Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

Improper Link Resolution CWE-59 in /usr/bin/larmstarter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group leading to root privilege escalation via a symlink attack on...

9.2CVSS0.00136EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/24 1:57 p.m.49 views

CVE-2026-12502

Loytec LINX firmware (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64 suffers CWE-269 due to improper privilege management in /usr/bin/ltsudo. The issue allows a user in the superadmin group to reset any LARM user password (including the larmapp s...

8.4CVSS5.9AI score0.00106EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/24 1:48 p.m.53 views

CVE-2026-7007 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

4.6CVSS0.0022EPSS
SaveExploits1References2
CVE
CVE
added 2026/07/24 1:48 p.m.37 views

CVE-2026-7007

The CVE-2026-7007 issue affects Zephyr ext2: the on-disk superblock validation did not require non-zero values for s_blocks_per_group and s_inodes_per_group. If either field is zero, get_ngroups() and get_itable_entry() perform divisions using those fields during mount, triggering a divide-by-zer...

4.6CVSS5.9AI score0.0022EPSS
SaveExploits1References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/24 1:48 p.m.13 views

CVE-2026-7007

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

4.6CVSS5.9AI score0.0022EPSS
SaveExploits1References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/24 1:48 p.m.15 views

CVE-2026-7007 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

4.6CVSS5.9AI score0.0022EPSS
SaveExploits1References2
OSV
OSV
added 2026/07/24 11:12 a.m.15 views

OESA-2026-3148 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

8CVSS5.3AI score0.00668EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/24 11:12 a.m.13 views

OESA-2026-3147 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

8CVSS5.3AI score0.00668EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/24 6:00 a.m.48 views

CVE-2026-12688 ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

0.00164EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/24 6:00 a.m.29 views

CVE-2026-12688

The CVE describes a vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.7 where PayPal IPN notifications are not verified before granting paid group membership. This allows unauthenticated attackers to Forge a payment notification and set any user as a paid member of any grou...

6.5CVSS5.4AI score0.00164EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/24 6:00 a.m.21 views

EUVD-2026-48489

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

6.5CVSS5.9AI score0.00164EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/24 12:00 a.m.42 views

PT-2026-64300

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

7.1CVSS6.3AI score0.00113EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/24 12:00 a.m.20 views

PT-2026-64305

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The ext2 file system fails to verify that the on-disk superblock fields s blocks per group and s inodes per group are non-zero during the mount process in the ext2 verify disk superblock...

4.6CVSS5.3AI score0.0022EPSS
SaveExploits1References7
The Hacker News
The Hacker News
added 2026/07/23 6:36 p.m.18 views

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor...

7.2CVSS7.3AI score0.19559EPSS
SaveExploits0
NVD
NVD
added 2026/07/23 12:18 p.m.20 views

CVE-2026-65897

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

8.8CVSS0.00523EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/23 11:42 a.m.25 views

CVE-2026-65897

Grav API Plugin before 1.0.10 is affected. The flaw in InvitationsController::create() fails to validate the groups field, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. When such invitations are accepted, the new account gain...

8.8CVSS5.4AI score0.00523EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/23 11:42 a.m.12 views

EUVD-2026-48247

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

8.8CVSS5.3AI score0.00523EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/22 2:30 p.m.19 views

SUSE-SU-2026:3195-1 Security update for sssd

This update for sssd fixes the following issues - CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation bsc1270709. - CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication...

8.8CVSS5.2AI score0.00668EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/22 12:22 p.m.17 views

openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the "DEFAULT" keyword. A less preferred key exchange may be used...

6.5CVSS7.3AI score0.00435EPSS
SaveExploits0References7
Rows per page
Query Builder