37248 matches found
CVE-2026-76962 Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)
SAP S/4HANA Manage Bank Chains app does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on...
CVE-2026-76962
SAP S/4HANA (Manage Bank Chains app) has insufficient authorization checks that allow an attacker with low privileges to send specially crafted requests to delete entries they should not be able to access. The impact is limited to availability (low severity), with no stated impact on confidential...
CVE-2026-86994: Missing Authorization
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...
CVE-2026-86996: Missing Authorization
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted...
CVE-2026-86993: Missing Authorization
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...
CVE-2026-86085: Missing Authorization
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the...
CVE-2026-86077: Missing Authorization
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...
CVE-2026-81904: Missing Authorization
Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration —...
CVE-2026-84869: Missing Authorization
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...
CVE-2026-81823: Missing Authorization
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...
CVE-2026-73014: Missing Authorization
Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally...
CVE-2026-69465: Missing Authorization
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
CVE-2026-47625: Missing Authorization
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service...
CVE-2026-72966: Missing Authorization
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally...
CVE-2026-69453: Missing Authorization
Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally...
CVE-2026-69403: Missing Authorization
Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally...
CVE-2026-83942: Missing Authorization
Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-69724: Missing Authorization
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...