Lucene search
+L

22975 matches found

EUVD
EUVD
added 2026/08/20 12:36 p.m.12 views

EUVD-2026-63325

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8...

5.3CVSS5.3AI score0.00176EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/20 8:20 a.m.23 views

CVE-2026-14953

Frauscher Sensortechnik's FDS102 device (R2) has improper RBAC enforcement at /api/user/fetch-all.php, allowing a low-privileged remote attacker to enumerate all users and identify privileged accounts (CVSS 5.3 MEDIUM). No patch version or in-the-wild exploitation details are provided in the docu...

5.3CVSS5.3AI score0.00197EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/20 8:20 a.m.32 views

CVE-2026-14953 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

5.3CVSS0.00197EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/20 12:35 a.m.11 views

EUVD-2026-62959

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...

8.3CVSS5.3AI score0.00258EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/20 12:35 a.m.15 views

EUVD-2026-62925

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

4.3CVSS5.3AI score0.00206EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/08/20 12:00 a.m.7 views

JetBrains YouTrack < 2026.1.13903 / 2026.2.x < 2026.2.17950 Information Disclosure (CVE-2026-75049)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.13903, or 2026.2.x prior to 2026.2.17950. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could read restricted articles from other projects via the draft creation...

6.5CVSS5.5AI score0.00259EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/08/20 12:00 a.m.7 views

JetBrains YouTrack < 2026.2.17917 Missing Authorization (CVE-2026-75051)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.17917. It is, therefore, affected by a missing authorization vulnerability: - Unauthorised project transfer between organisations was possible. CVE-2026-75051 Note that Nessus has not tested for this issue but has...

8.1CVSS5.4AI score0.0022EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/20 12:00 a.m.13 views

PT-2026-79095

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description Page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde...

6.5CVSS5.2AI score0.00239EPSS
SaveExploits0References10
Tenable Nessus
Tenable Nessus
added 2026/08/20 12:00 a.m.10 views

JetBrains YouTrack < 2026.2.18112 Information Disclosure (CVE-2026-75046)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18112. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could enumerate accounts via the users search endpoint. CVE-2026-75046 Note that Nessus has not tested for this...

4.3CVSS5.5AI score0.00206EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/19 10:34 p.m.2 views

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus Da Subscriber autenticato ad Amministratore tramite l'azione AJAXdo-reinstall 〔 1 〕 Vulnerabilità Causa principale: Ajax::handlerequest registra l'azione AJAX demoimporterplus senza chiamare currentusercan. Qualsiasi subscriber autenticato può inviare...

8.8CVSS5.7AI score0.00347EPSS
SaveExploits1References1
NVD
NVD
added 2026/08/19 10:17 p.m.7 views

CVE-2026-76394

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...

8.3CVSS0.00258EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/19 9:35 p.m.39 views

CVE-2026-76394 Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...

8.3CVSS0.00258EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 9:35 p.m.19 views

CVE-2026-76394

Splunk AI Toolkit versions below 6.0.0 have multiple REST API handlers that fail to enforce authorization checks, allowing low-privileged users (without admin or power roles) to start/stop/configure containers and read/modify connection and configuration data. CVSS 8.3 HIGH; remediation is to upg...

8.3CVSS5.3AI score0.00258EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/19 9:34 p.m.34 views

CVE-2026-76368 Missing Authorization through Playbooks in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before...

2.7CVSS0.00218EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 9:34 p.m.17 views

CVE-2026-76368

CVE-2026-76368 is a missing authorization flaw in Splunk SOAR versions below 8.6.0 . The Playbook History feature does not check repository permissions before returning playbook revision metadata, allowing a user who holds the playbooks:view permission to view metadata about playbook repositories...

2.7CVSS5.3AI score0.00218EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/19 9:34 p.m.35 views

CVE-2026-76360 Information Disclosure through Missing Authorization in the Health REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

4.3CVSS0.00206EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 9:34 p.m.10 views

CVE-2026-76360

Splunk SOAR versions below 8.6.0 are affected by a missing authorization check on the /rest/health endpoint, allowing authenticated users with no role to retrieve restricted system and cluster telemetry; CVSS 4.3 MEDIUM, remediation is to upgrade to version 8.6.0. Exploitation details are not pro...

4.3CVSS5.3AI score0.00206EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/19 9:34 p.m.33 views

CVE-2026-76348 Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege listsearchheadclustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a...

3.8CVSS0.00231EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/19 9:34 p.m.12 views

CVE-2026-76348

CVE-2026-76348 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The vulnerability resides in Search Head Cluster member control endpoints , which do not require a state-changing HTTP request type before applying read-only authorization. A user holding the high-privile...

3.8CVSS5.3AI score0.00231EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/08/19 9:34 p.m.17 views

CVE-2026-76340

Splunk Enterprise 10.4.x versions below 10.4.2 are affected by a missing authorization vulnerability in the REST API . The token-key reload endpoint does not require authentication or the change_authentication capability, allowing an unauthenticated attacker to force a reload of token-signing key...

5.3CVSS5.4AI score0.0027EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder