153384 matches found
CVE-2026-40145
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-40145
BeyondTrust Endpoint Privilege Management (Windows deployment) support utility has a tamper-protection bypass where, under certain conditions, protections on the utility process are not enforced as intended. CVSS 7.1 HIGH requires local access with high privileges. No affected versions, root caus...
CVE-2026-40145 Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-15754
Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...
CVE-2026-16045
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...
CVE-2026-72059
A flaw was found in the Linux kernel's net: wwan: t7xx component. This issue occurs during the initialization of the Cellular Direct Memory Access CLDMA module. If the setup of the transmit or receive rings fails, a dedicated memory resource, known as a Direct Memory Access DMA pool, is not...
CVE-2026-68463
A flaw was found in the Linux kernel, specifically within the mmc: sdhci-esdhc-imx component responsible for managing multimedia card MMC host controllers. During system suspend operations, an error in power management could cause the system to attempt accessing hardware that is not properly...
EUVD-2026-60210
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...
CVE-2026-16045
Mattermost 11.7.x (≤11.7.6) and 10.11.x (≤10.11.21) failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions. A malicious OAuth app holding a delegated user token could revoke the user's authorizations or tokens for unrelated integrations via...
CVE-2026-16045
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...
UBUNTU-CVE-2026-75004
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...
CVE-2026-74894
opensslencrypt before 1.4.0 contains an authentication bypass vulnerability in the verifyapitoken function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bear...
CVE-2026-74894
The PHP package openssl_encrypt before version 1.4.0 has a broken verify_api_token function that accepts any non-empty Bearer token, allowing unauthenticated attackers to upload arbitrary public keys, enumerate all keys, and revoke any user's keys. CVSS 9.8 Critical. Upgrade to 1.4.0. No in-the-w...
EUVD-2026-60113
opensslencrypt before 1.4.0 contains an authentication bypass vulnerability in the verifyapitoken function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bear...
CVE-2026-74845
CVE-2026-74845 concerns the Official Document Management System by 2100 Technology, with an Arbitrary File Upload vulnerability that enables authenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server. From the connected references, ...
EUVD-2026-60077
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-74845 2100 Technology｜Official Document Management System - Arbitrary File Upload
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...