Lucene search
+L

22069 matches found

CVE
CVE
added 2026/07/28 10:39 a.m.13 views

CVE-2026-18028

CVE-2026-18028 describes a missing authorization check in the "+quick setup+" view presented after creating an event. The flaw allows an attacker to send well-timed requests to perform privileged actions on events the user should not access, including creating products, quotas, configuring bank t...

2.3CVSS5.9AI score0.00207EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/28 9:16 a.m.8 views

CVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

8.8CVSS0.00277EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/28 9:7 a.m.8 views

CVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

8.8CVSS6AI score0.00277EPSS
SaveExploits0References2Affected Software6
EUVD
EUVD
added 2026/07/28 9:7 a.m.6 views

EUVD-2026-49729

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

8.8CVSS6AI score0.00277EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/28 5:39 a.m.7 views

CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

5.3CVSS5.8AI score0.00209EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/28 5:39 a.m.37 views

CVE-2026-12124 PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

5.3CVSS0.00209EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.12 views

PT-2026-65446

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator google contacts fetch labels, automator mautic segment fetch, automator mautic tags fetch, and...

7.5CVSS5.8AI score0.00514EPSS
SaveExploits0References15
Tenable Nessus
Tenable Nessus
added 2026/07/28 12:0 a.m.7 views

Kibana 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-70 / ESA-2026-73)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-70 and ESA-2026-73 advisories. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure v...

4.3CVSS5.9AI score0.00181EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/07/28 12:0 a.m.6 views

Kibana 9.3.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-65 / ESA-2026-67)

The version of Kibana installed on the remote host is 9.3.x prior to 9.3.8 or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-65 and ESA-2026-67 advisories. - Missing Authorization CWE-862 in Kibana allows an authenticated user to access...

6.3CVSS6AI score0.00202EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.12 views

PT-2026-65450

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs send email AJAX handler. This is due to the wpcs send email function being registered on both wp ajax wpcs send email and wp ajax nopriv wpcs send email with no nonce...

5.3CVSS5.9AI score0.00235EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/27 1:18 p.m.9 views

CVE-2026-59690

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

8CVSS0.00175EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/27 12:26 p.m.7 views

CVE-2026-59690 Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

8CVSS5.8AI score0.00175EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/27 12:26 p.m.9 views

EUVD-2026-49188

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

8CVSS5.9AI score0.00175EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/27 12:26 p.m.10 views

CVE-2026-59690

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

8.4CVSS5.9AI score0.00734EPSS
SaveExploits0References2Affected Software5
Cvelist
Cvelist
added 2026/07/27 12:26 p.m.35 views

CVE-2026-59690 Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

8CVSS0.00175EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.16 views

PT-2026-64905

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

8.4CVSS6AI score0.00717EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/07/27 12:0 a.m.7 views

Xerox AltaLink Missing Authorization (CVE-2021-28669)

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights. This plugin only works with Tenable.ot. Please visit...

7.5CVSS7.1AI score0.00791EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 9:54 p.m.11 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the updateUser process of the API endpoint, which fails to enforce proper authorization checks for editing superuser accounts and changing user passwords. An attacker can gain full administrative access by sendi...

8.8CVSS5.9AI score
SaveExploits0References3
NVD
NVD
added 2026/07/24 5:17 p.m.10 views

CVE-2026-65708

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

8.6CVSS0.00221EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/24 4:0 p.m.9 views

EUVD-2026-48716

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

7.1CVSS5.9AI score0.00178EPSS
SaveExploits0References2
Rows per page
Query Builder