CVE-2025-40602

CVE-2025-40602 CVE-2025-40602 es una vulnerabilidad de escalada de privilegios local en la consola de gestión del dispositivo AMC de los dispositivos SonicWall Secure Mobile Access SMA serie 1000. La vulnerabilidad se origina por una autorización insuficiente en la AMC, lo que permite a atacantes...

CVE-2025-40602

CVE-2025-40602 📌 Resumen CVE-2025-40602 es una vulnerabilidad de escalada de privilegios local que afecta a los dispositivos SonicWall Secure Mobile Access SMA 1000. El fallo existe en la Appliance Management Console AMC debido a controles de autorización insuficientes , lo que permite a un usuar...

CVE-2026-34048

CVE-2026-34048 Rutas de bootstrap de terminal solo para administradores verificaban únicamente el estado de inicio de sesión, lo que permitía a un miembro normal del equipo manejar el backend de terminal en tiempo real de Coolify y ejecutar comandos en los servidores del equipo. Introducción...

PT-2026-99232

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient authorization for non-owner users allows the execution of MCP configuration changes via the '/mcp set' and '/mcp unset' endpoints. This flaw enables attackers to persist arbitrary...

PT-2026-99223

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Insufficient validation of owner authorization occurs within the Codex computer-use installation command. This allows senders in a channel who are not owners to install arbitrary plugins and...

CVE-2026-100177

The AIL Framework crawler task creation API apiaddcrawlertask contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared...

EUVD-2026-87091

The AIL Framework crawler task creation API apiaddcrawlertask contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared...

PT-2026-98848

The AIL Framework crawler task creation API api add crawler task contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compar...

PT-2026-99060

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description Insufficient authorization checks exist within the FormThemeController write endpoints for global form themes and categories. This allows authenticated users without administrative privileges...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95697

MISP contains an authorization flaw in the Organisation model's captureOrg method . When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. An authenticated user with at leas...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

PT-2026-94172

Name of the Vulnerable Software and Affected Versions PuppyFW versions prior to 0.4.5 Description Insufficient authorization on a REST route allows any authenticated user, including those with subscriber roles, to add, modify, or delete arbitrary blog options. This occurs because the plugin...

CVE-2026-76423

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

EUVD-2026-81107

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

PT-2026-93699

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization enforcement in the CrmCustomerController allows any authenticated back-office user to send unauthorized SMS and email messages to arbitrary customers. This is possible by...

PT-2026-93931

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.11.0 Description Certain REST API methods used for replacing Process Group contents, versioned flow updates, and rebase operations lack sufficient authorization checks. While asynchronous update methods...

PT-2026-93700

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization enforcement on the 'saveRedisSet' and 'getRedisSet' endpoints within the CrmCustomerController allows authenticated back-office users to read and modify installation-wide...

PT-2026-93706

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization checks in the CrmFlowController deleteFlowStep function allow any authenticated back-office user to delete arbitrary approval workflow steps. This can be achieved by...