9569 matches found
CVE-2026-12065: Improper Authorization in Handler for Custom URL Scheme
A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical...
CVE-2026-53407: Improper Authorization in Handler for Custom URL Scheme
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access...
PT-2026-48966
Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An improper authorization issue allows an authenticated organization administrator to access or modify user settings of site administrator accounts within the same organization. This occurs...
PT-2026-48948
Name of the Vulnerable Software and Affected Versions Camaleon CMS version 2.9.2 Description Improper authorization in the administrator draft autosave endpoint allows a low-privileged authenticated user to overwrite a draft associated with another user's post. This is achieved by sending an...
CVE-2026-10715: Missing Authorization
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype/ /drafts and overwrite the draft associated with another user's post...
PT-2026-114690
Уязвимость компонента Paint веб-браузеров Google Chrome и Microsoft Edge связана с неправильной авторизацией. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к защищаемой информации с помощью специально созданной HTML-страницы...
Camaleon CMS 2.9.2 contains an improper authorization
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary postid to POST /admin/posttype//drafts and overwrite the draft associated with another user's post...
GHSA-6P54-FW2F-Q7GF DevGuard has improper authorization on public assets
Impact On a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create, update, reapply, and delete VEX rules on those public assets. The same flaw affects the oth...
Improper Authorization
Twig is vulnerable to Improper Authorization. The vulnerability is due to incomplete enforcement of sandbox security checks for implicit toString calls, which allows an attacker to invoke non-allowlisted toString methods on accessible objects and bypass configured security policies...
GitLab Enterprise Edition（EE） 安全漏洞
GitLab Enterprise Edition EE is a content management system provided by the American company GitLab. Versions of GitLab EE prior to 15.5, 18.10.8, 18.11.5, and 19.0.2 contained security vulnerabilities. These vulnerabilities were caused by improper authorization in the Group SAML identity...
CVE-2026-47298
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
CVE-2026-42902
Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally...
CVE-2026-45490
A flaw was found in the .NET SDK dotnet.exe workload command on Windows. Insufficient access controls on a named pipe could allow a local attacker to perform arbitrary file creation or truncation operations with the privileges of another local user. This issue may lead to privilege escalation and...
Improper Authorization
fuxa-server is vulnerable to Improper Authorization. The vulnerability is due to missing or insufficient authorization checks on scheduled action management operations, which allows an authenticated non-admin attacker to create or modify actions that should be restricted to administrators...
QNAP Systems File Station 6 安全漏洞
QNAP Systems File Station 6 is a file management software developed by QNAP Systems, a company based in Taiwan, China. QNAP Systems File Station 6 has a security vulnerability that stems from improper authorization. This vulnerability could allow remote attackers to bypass intended access...
CVE-2026-46668: Improper Authorization
SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0...
CVE-2026-47342: Improper Authorization
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue...
The vulnerability of the AI agent OpenClaw (formerly known as ClawdBot or MoltBot) arises from an improper authorization process based on a list of permitted senders. This allows attackers to bypass existing security mechanisms.
The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to an incorrect authorization process based on a list of permitted senders. Exploiting this vulnerability could allow a hacker to bypass existing security mechanisms...
