Lucene search
+L

22667 matches found

Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.4 views

PT-2026-70033

Name of the Vulnerable Software and Affected Versions SAP ABAP Development Tools affected versions not specified Description SAP ABAP Development Tools fails to perform required authorization checks for specific functionality. This allows an attacker with low privileges to execute unauthorized...

8.8CVSS5.2AI score0.00331EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.3 views

PT-2026-70693

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...

6.5CVSS5.1AI score0.00577EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.5 views

PT-2026-70024

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A missing authorization check allows an unauthenticated attacker to access backend operations by sending crafted requests to the 'Cost Servlet' endpoint...

7.3CVSS5.2AI score0.0024EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.4 views

PT-2026-70772

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...

8.1CVSS5.2AI score0.00603EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/10 9:44 p.m.56 views

CVE-2026-72919

Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 exposes a broken access control in the channels.convertToTeam REST endpoint. An authenticated user with the create-team permission could convert an unrelated public channel by providing channelName instead ...

4.3CVSS5.3AI score0.00238EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/10 8:47 p.m.17 views

CVE-2026-72906 ERPNext: Unauthorised triggering of automated emails due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated...

4.3CVSS5.3AI score
SaveExploits0References8
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/10 7:59 p.m.24 views

Security Bulletin: Vault Enterprise vulnerable to cross-namespace entity deletion

Summary Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability CVE-2026-14886 ...

8.2CVSS5.3AI score0.00239EPSS
SaveExploits0Affected Software1
CVE
CVE
added 2026/08/10 6:28 p.m.49 views

CVE-2026-72863

Dokploy before 0.29.13 has a missing authorization check in WebSocket handlers (in-app terminals and log streamers) that authenticate a session but do not enforce role-based access. Any authenticated user can open an interactive shell into any container on the host (including the Dokploy containe...

9.9CVSS5.4AI score0.00298EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/10 6:26 p.m.47 views

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 expose a missing authorization vulnerability in POST /api/v1/openai-assistants-file/download. An unauthenticated attacker can bypass the global authentication whitelist to bypass session and API key verification and retrieve private files by supplying valid ch...

8.7CVSS5.5AI score0.00448EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/08/10 6:26 p.m.11 views

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS5.5AI score0.00448EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 2026/08/10 6:26 p.m.14 views

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS5.5AI score0.00448EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/10 6:26 p.m.27 views

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS0.00448EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/10 6:26 p.m.21 views

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS5.5AI score
SaveExploits0References6
EUVD
EUVD
added 2026/08/10 12:14 p.m.10 views

EUVD-2026-55618

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

8.7CVSS5.3AI score0.00238EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/10 12:14 p.m.36 views

CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

8.7CVSS0.00238EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/10 12:14 p.m.43 views

CVE-2026-59233

CVE-2026-59233 affects Roskus Prospero Flow CRM prior to 5.2.1 in the permission management component. The permission save endpoint performs no authorization check, allowing any authenticated user to grant any role the full set of application permissions via a crafted POST request, enabling privi...

8.7CVSS5.3AI score0.00238EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/10 12:14 p.m.23 views

CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

8.7CVSS5.3AI score
SaveExploits0References6
OSV
OSV
added 2026/08/10 11:59 a.m.9 views

CVE-2026-72692 OpenSignLabs opensignserver - Missing Authorization

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes...

7.5CVSS5.6AI score
SaveExploits0References3
CVE
CVE
added 2026/08/10 11:59 a.m.37 views

CVE-2026-72692

OpenSignLabs opensignserver up to version 2.37.0 contains a missing authorization flaw in the declinedoc Parse cloud function. An unauthenticated remote attacker can irreversibly decline any in‑flight document and forge the decline attribution to an arbitrary user by writing IsDeclined, DeclineRe...

7.5CVSS5.5AI score0.00272EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/10 9:38 a.m.43 views

CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...

6.5CVSS0.00316EPSS
SaveExploits0References2
Rows per page
Query Builder