59093 matches found
CVE-2026-19197
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...
CVE-2026-19197
CVE-2026-19197 is a broken access control vulnerability in Grafana 's dashboard snapshots feature. An organization administrator on a shared Grafana instance can delete snapshots belonging to other organizations and recover a snapshot's secret delete key using only its public share key , enabling...
CVE-2026-19197 Broken access control in dashboard snapshots
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...
CVE-2026-19197 Broken access control in dashboard snapshots
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...
CVE-2026-19718 BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery
The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...
CVE-2026-19718 BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery
The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...
CVE-2026-19718
The BlogVault Backup & Staging , MalCare WordPress Security , and The WP Remote WordPress plugins (all versions before 6.65 ) are vulnerable to an unauthenticated site takeover. The root cause is a weak pseudo-random number generator used to create the secret that binds a site to its remote manag...
Malicious code in fivem-tool-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11831d8204f695d6cfc23750c0899851f375e519e715e845730f90b7fc8d51a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2026-66229
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-29988
Milesight IoT devices (multiple models, affected firmware versions) are vulnerable to cleartext transmission of sensitive information through the NFC interface. An unauthenticated attacker with physical proximity can read LoRaWAN ABP NwkSKey , AppSKey , and D2D keys via a simple NFC read operatio...
CVE-2026-29988
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
EUVD-2026-66228
duplicate record...
PT-2026-81925
A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...
CVE-2026-74771: Authorization Bypass Through User-Controlled Key
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...
CVE-2023-42179: Improper Access Control
Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...
CVE-2026-12587: Use of Hard-coded Credentials
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...
CVE-2026-80204: Incorrect Authorization
The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...
CVE-2026-80203: Incorrect Authorization
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
CVE-2026-77557: Improper Access Control
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device...