The vulnerability of the “Tekon” SCADA system, related to the incorrect assignment of permissions for critical resources, allows for the increase of its privileges.

The vulnerability of the “Tekon” SCADA system is related to the incorrect assignment of permissions for critical resources. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

CVE-2025-4162028

Security Advisory: CVE-2025-4162028 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

CVE-2023-47564

CVE-2023-47564 https://www.qnap.com/en/security-advisory/qsa-24-03 https://vulners.com/cve/CVE-2023-47564 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 8.1 "An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the...

CVE-2025-4162029

Security Advisory: CVE-2025-4162029 The content provided on this website is available for informational purposes only and may be accessed and used by search engines or language models LLMs with the following restrictions: The content may be reproduced, summarized, or utilized in derivative works,...

Blackash-CVE-2025-41115

🔐 CVE-2025-41115: Critical Grafana SCIM Privilege Escalation Critical SCIM Privilege-Escalation Vulnerability in Grafana Enterprise 🌟 Summary CVE-2025-41115 is a Critical CVSS 10.0 vulnerability in Grafana Enterprise affecting its SCIM user-provisioning feature. When SCIM provisioning is enabled...

CVE-2026-73470

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

CVE-2026-84206

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

PT-2026-84304

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

SUSE CVE-2026-72021

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

CVE-2026-6469

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the...

CVE-2026-18996 cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

CVE-2026-18996

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component runcommand Handler. Such manipulation leads to incorrect privilege assignment. Th...

EUVD-2026-53698

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function gettooldefinitions of the file agent/agentinit.py of the component disabledtoolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The explo...

CVE-2026-18976

The CVE affects NousResearch hermes-agent up to version 0.16.0. The vulnerability impacts the get_tool_definitions function in agent/agent_init.py within the disabled_toolsets Handler, where manipulation leads to incorrect privilege assignment. The issue could be exploited remotely and an exploit...

CVE-2026-18976 NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function gettooldefinitions of the file agent/agentinit.py of the component disabledtoolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The explo...

CVE-2026-18976 NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function gettooldefinitions of the file agent/agentinit.py of the component disabledtoolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The explo...

CVE-2026-16157 Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write...

The vulnerability in the driver/net/ppp/ppp_generic.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the driver/net/ppp/pppgeneric.c component in the Linux operating system is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to cause a service failure...