91609 matches found
DEBIAN-CVE-2025-49506
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
CVE-2026-18277 Missing Authorization in eScriptorium
Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...
CVE-2026-18276 Missing Authorization in eScriptorium
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...
libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows setting a spatiallayerid exceeding the configured number of layers. This causes an out-of-bounds heap rea...
EUVD-2026-53935
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...
Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
Microsoft Teams Elevation of Privilege Vulnerability
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...
Missing Critical Step in Authentication
Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the scope parameter processing of the OAuth2 Dynamic Client Registration endpoint. An attacker can obtain unauthorized access t...
MINI-2Q9M-8XXP-V452
Bulletin has no description...
MINI-8GGP-3XVV-5P3P
Bulletin has no description...
MINI-MM2G-WFQ4-28X2
Bulletin has no description...
MINI-RHC3-P6J2-9227
Bulletin has no description...
MINI-W2WX-XR89-64VX
Bulletin has no description...
Exploit for Missing Authentication for Critical Function in Microsoft
CVE-2026-56164 — Microsoft SharePoint Server Authentication By...
CVE-2026-65551
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...
EUVD-2026-53875
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...
CVE-2026-65551
CVE-2026-65551 concerns the WordPress WordPress Breakdance plugin (versions up to and including 2.6.1) where a Broken Access Control / Missing Authorization flaw exists. The root cause is incorrectly configured access control levels, enabling unauthorized actions due to insufficient restriction o...
