CVE-2025-40602

CVE-2025-40602 📌 Resumen CVE-2025-40602 es una vulnerabilidad de escalada de privilegios local que afecta a los dispositivos SonicWall Secure Mobile Access SMA 1000. El fallo existe en la Appliance Management Console AMC debido a controles de autorización insuficientes , lo que permite a un usuar...

CVE-2026-76423

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

EUVD-2026-81107

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit...

CVE-2025-40602

CVE-2025-40602 CVE-2025-40602 es una vulnerabilidad de escalada de privilegios local en la consola de gestión del dispositivo AMC de los dispositivos SonicWall Secure Mobile Access SMA serie 1000. La vulnerabilidad se origina por una autorización insuficiente en la AMC, lo que permite a atacantes...

CVE-2026-34048

CVE-2026-34048 仅检查登录状态的管理员终端引导路由，使得普通团队成员能够驱动 Coolify 的实时终端后端并在团队服务器上执行命令。 简介 我在审查 Coolify （一个开源的自托管 PaaS）时发现了这个问题，当时我心中有一个非常直接的安全性问题： 终端访问是否在后端信任边界处实际强制执行，还是仅在 UI 中？ 在这个案例中，答案是糟糕的。 Coolify 本意是将终端访问限制为团队管理员和所有者，但实时终端引导路由仅检查用户是否已登录。这使得低权限的团队成员能够满足 websocket 终端的信任检查，从而在团队服务器上执行命令。...

EUVD-2026-78089

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-77705

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

...[ More ]

Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...

CVE-2026-65181

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

EUVD-2026-74800

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

EUVD-2026-72533

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

EUVD-2026-72582

SAP S/4HANA Manage Bank Chains app does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on...

CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-86417 MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates. The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, the same authenticated user who saw redacted data in the normal...

CVE-2026-86090

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...

CVE-2026-81819

Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...

CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

EUVD-2026-65441

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

CVE-2026-76336

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...