30 matches found
EUVD-2026-75234
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...
CVE-2026-86451
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...
CVE-2026-76607
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...
CVE-2026-76596 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...
EUVD-2026-64319
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.3 - ???...
CVE-2026-76607 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...
CVE-2026-76607
Fabrik , a Joomla extension by fabrikar.com, is vulnerable to a missing ACL (Access Control List) check in its download element in versions prior to 4.7.3 . This flaw allows unauthenticated remote attackers to access download functionality without proper authorization, leading to high impact on c...
CVE-2026-76607 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...
CVE-2026-76607: Improper Access Control
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...
PT-2026-79572
Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An issue exists where the list controllers' empty endpoints lack Access Control List ACL gates. This allows an unauthenticated user to perform table truncation, effectively emptying the target list's...
PT-2026-79583
Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.3 Description The download element in the Fabrik extension for Joomla lacks a proper Access Control List ACL check. An ACL is a security mechanism that regulates which users or system processes are granted access t...
SUSE CVE-2026-65959
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...
CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...
CVE-2026-49989
CrateDB prior to 6.2.8 and 6.3.2 exposes an authorization bypass in the HTTP blob API. The HTTP path (GET/PUT/DELETE /_blobs/{table}/{digest}) authenticates requests but does not enforce privileges via AccessControl, unlike the SQL path. As a result, any authenticated user who knows a blob’s SHA-...
CVE-2026-29189: Authorization Bypass Through User-Controlled Key
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL Access Control List checks on several endpoints, allowing authenticated users to access and manipulate data they...
CVE-2025-54866
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files x86\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in...
EUVD-2025-198508
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files x86\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in...
CVE-2025-54866 Wazuh installation fails to protected authd.pass on Windows
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files x86\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in...
Wazuh 安全漏洞
Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A security vulnerability exists in Wazuh versions 4.3.0 through prior to 4.13.0, which stems from a missing ACL in...