23005 matches found
CVE-2026-69115
OpenIM Server v3.8.3 is affected by a missing authorization vulnerability that lets any authenticated user access admin-only management endpoints. Specifically, POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups bypass an authverify.C...
CVE-2026-69115 OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...
CVE-2026-69115
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...
CVE-2026-69115 OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...
CVE-2026-70340
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
CVE-2026-65806
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...
CVE-2026-61936
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally...
CVE-2026-59113
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-59113
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
EUVD-2026-56592
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...
EUVD-2026-56591
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
EUVD-2026-56417
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network...
EUVD-2026-56340
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally...
CVE-2026-59113
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
EUVD-2026-56304
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
EUVD-2026-56299
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network...
CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...
CVE-2026-56720
CVE-2026-56720 — CamaleonCMS
CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...
