CVE-2025-40602

CVE-2025-40602 CVE-2025-40602 は、SonicWall Secure Mobile Access SMA 1000 シリーズアプライアンスのアプライアンス管理コンソール AMC におけるローカル権限昇格の脆弱性です。この脆弱性は、AMC の不十分な認可に起因し、認証済みのリモート攻撃者が影響を受けるデバイス上で権限を昇格させることを可能にします。CVE-2025-23006 と連鎖させることで、攻撃者は認証を必要としないリモートコード実行を root 権限で達成できます。このゼロデイ脆弱性は実際に積極的に悪用されており、2025年12月17日に CISA...

CVE-2025-40602

CVE-2025-40602 📌 概要 CVE-2025-40602 は、SonicWall Secure Mobile Access SMA 1000 シリーズアプライアンスに影響を与えるローカル権限昇格の脆弱性 です。 この欠陥は、Appliance Management Console AMC における不十分な認可チェック に起因し、認証された低権限ユーザーが権限を昇格させることが可能になります。 この脆弱性は、実際の攻撃 in the wild で積極的に悪用されている ことが確認されており、特に他の脆弱性と連鎖させてシステム全体を完全に侵害するために使用されています。 📝...

CVE-2026-34048

CVE-2026-34048 管理者専用のターミナルブートストラップルートがログイン状態のみをチェックしていたため、通常のチームメンバーがCoolifyのリアルタイムターミナルバックエンドを操作し、チームサーバー上でコマンドを実行できるようになっていました。 はじめに この問題は、オープンソースのセルフホスト型PaaSであるCoolify をレビュー中に発見しました。その際、非常に直接的なセキュリティ上の問いを念頭に置いていました。 ターミナルアクセスは、実際にバックエンドの信頼境界で強制されているのか、それともUIだけで行われているのか？ 今回のケースでは、答えは悪いものでした。...

PT-2026-99223

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient validation of owner authorization occurs within the Codex computer-use installation command. This allows senders in a channel who are not owners to install arbitrary plugins and...

CVE-2026-100177

The AIL Framework crawler task creation API apiaddcrawlertask contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared...

EUVD-2026-87091

The AIL Framework crawler task creation API apiaddcrawlertask contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared...

PT-2026-99060

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description Insufficient authorization checks exist within the FormThemeController write endpoints for global form themes and categories. This allows authenticated users without administrative privileges...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95697

MISP contains an authorization flaw in the Organisation model's captureOrg method . When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. An authenticated user with at leas...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-76423

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

EUVD-2026-81107

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

EUVD-2026-78089

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-77705

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

PT-2026-90560

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

...[ More ]

Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...

Apache Impala 4.5.1 Insufficient Authorization Remote Code Execution

Summary Apache Impala is a modern, open source, distributed SQL query engine for open data and table formats. Description Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC tak...