Lucene search
+L

22924 matches found

CVE
CVE
added 2026/08/19 6:48 p.m.39 views

CVE-2026-16938

IBM Power Systems Firmware (FSP) is affected by a missing authorization flaw (CWE-862) in access controls over privileged system configuration operations. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode , dis...

6.9CVSS5.4AI score0.00138EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/19 6:48 p.m.38 views

CVE-2026-16938 Power System Missing Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to...

6.9CVSS0.00138EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 6:37 p.m.46 views

CVE-2026-16930

Power Systems Firmware versions FW1120.00, FW1110.00–.30, and FW1060.00–.80 are affected by CWE-862 (Missing Authorization), allowing a privileged BMC/FSP user to execute arbitrary code on the host and all partitions. Upgrade to FW1110.31, FW1120.01, or FW1060.81 (or newer) per the IBM Security B...

8.2CVSS6AI score0.00118EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/19 6:37 p.m.41 views

CVE-2026-16930 Power System Missing Authorization

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system,...

8.2CVSS0.00118EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/19 6:23 p.m.12 views

CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...

4.3CVSS5.4AI score
SaveExploits0References5
CVE
CVE
added 2026/08/19 6:23 p.m.20 views

CVE-2026-55703

Snipe-IT (IT asset/license management system) prior to 8.6.3 contains an authorization bypass in MaintenancesController::show(). The method renders a maintenance record without calling authorize(), unlike all sibling actions (index, edit, update, destroy) which properly gate on the asset. Any act...

4.3CVSS5.3AI score0.00193EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/19 3:17 p.m.12 views

CVE-2026-58565

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

8.8CVSS0.00093EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/19 3:17 p.m.10 views

CVE-2026-58562

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

7.3CVSS0.00092EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 2:59 p.m.35 views

CVE-2026-58565

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low-privileged attacker with local access can exploit this flaw to achieve Elevation of Privileges , resulting in full compromise of confidentiality, integrity, and availability (CVSS 3.1: 8.8 HIGH ...

8.8CVSS5.3AI score0.00093EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/08/19 2:59 p.m.8 views

EUVD-2026-62521

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

8.8CVSS5.3AI score0.00093EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/19 2:59 p.m.40 views

CVE-2026-58565

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

8.8CVSS0.00093EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 2:55 p.m.18 views

CVE-2026-58562

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low-privileged attacker with local access and user interaction could exploit this to gain unauthorized access to the system. The CVSS 3.1 score is 7.3 (HIGH) with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/...

7.3CVSS5.3AI score0.00092EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/08/19 2:55 p.m.8 views

EUVD-2026-62512

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

7.3CVSS5.3AI score0.00092EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/19 2:55 p.m.36 views

CVE-2026-58562

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

7.3CVSS0.00092EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/19 2:37 p.m.12 views

CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

8.7CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/19 2:37 p.m.25 views

CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

8.7CVSS0.00408EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/19 2:02 p.m.9 views

CVE-2026-76215 phpMyFAQ before 4.1.7 Missing Authorization via child resources

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

6.9CVSS5.5AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/19 2:02 p.m.27 views

CVE-2026-76215 phpMyFAQ before 4.1.7 Missing Authorization via child resources

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

6.9CVSS0.00244EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/19 11:56 a.m.5 views

PYSEC-2026-3677 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...

6.5CVSS5.8AI score0.00081EPSS
SaveExploits0References7
OSV
OSV
added 2026/08/19 8:45 a.m.4 views

BIT-KIBANA-2026-72669 Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

7.6CVSS5.7AI score0.00223EPSS
SaveExploits0References2
Rows per page
Query Builder