6314 matches found
CVE-2026-18620
CVE-2026-18620 affects Data Science Pipelines. A restricted user/tenant can abuse an improper authorization in the setDefaultServiceAccount function by supplying a more privileged ServiceAccount in a CreateRun request, bypassing checks and enabling containers to run with elevated privileges. This...
EUVD-2026-55826
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...
CVE-2026-18620 Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...
CVE-2026-18620
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...
CVE-2026-72690
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...
CVE-2026-72575
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...
CVE-2026-72575
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...
CVE-2026-72575 daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...
EUVD-2026-55231
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...
CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
EUVD-2026-55242
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
EUVD-2026-55100
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
PT-2026-69959
Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An improper authorization issue exists in the setDefaultServiceAccount function. A restricted user or tenant can bypass authorization checks by specifying a more privileged...
Security Bulletin: IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (CVE-2026-10543)
Summary IBM® Db2® is vulnerable to privilege escalation with a specially crafted query. Vulnerability Details CVEID:CVE-2026-10543 DESCRIPTION: IBM Db2 is vulnerable to privilege escalation with a specially crafted query. CWE:CWE-285: Improper Authorization CVSS Source: IBM CVSS Base score: 8.2...
EUVD-2026-54314
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...