CVE-2026-49060-Lab

CVE-2026-49060 - Hippoo Mobile App for WooCommerce Incorrect Privilege Assignment / Privilege Escalation Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-49060, an Incorrect Privilege Assignment vulnerability affecting the WordPress plugin Hipp...

CVE-2023-2640-3262-PoC

CVE-2023-2640/3262-PoC Pruebas de concepto mínimas para vulnerabilidades de escalada de privilegios locales en Ubuntu OverlayFS. CVEs CVE-2023-2640 – Problema de manejo de permisos en OverlayFS CVE-2023-3262 – Problema de escalada de capacidades en OverlayFS Archivos CVE-2023-2640.sh – Prueba...

CVE-2022-26629

Lock Screen Bypass CVE-2022-26629 Affected Products SoroushPlus+ Messenger 1.0.30 Vulnerability Type Improper Access Control Impact Lock Screen Bypass Summary Improper handling of insufficient permissions and privileges allows an attacker to modify and overwrite the lock screen functionality...

CVE-2026-79783

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the way samba handled file and directory permissions. A authenticated user could exploit this flaw to gain access to certain file and directory information that would otherwise be unavailable to the attacker...

EUVD-2026-53546

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-11804

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise...

PT-2026-57271

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0 Description In the IT asset and license management system, the update function within UsersController incorrectly handles missing permission request fields when processed through NormalizePermissionsPayloadActi...

CVE-2026-41566

CVE-2026-41566 affects Apache Kvrocks 2.8.0 and is described as an improper handling of insufficient permissions or privileges, specifically related to the APPLYBATCH command. The issue is rated high risk (CVSS 4.0 base 9.4) with impact on confidentiality, integrity, and availability. No exploita...

CVE-2026-40371

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 on-premises allows an authorized attacker to elevate privileges over a network...

CVE-2026-40371

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 on-premises allows an authorized attacker to elevate privileges over a network...

CVE-2026-40371

Technical details (affected product/component, root cause, and fix) are not publicly available in the provided documents. Monitor for updates.

Important: libnvsdm

Issue Overview: NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a critical resource. A successful exploit of this vulnerability might lead to data tampering and denial of service...

Important: runfinch-finch

Issue Overview: An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state a...

CVE-2026-11254

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

SAMSUNG Mobile devices 安全漏洞

Samsung Mobile devices are a series of mobile devices produced by Samsung Electronics in South Korea. This includes smartphones, tablets, etc. Devices prior to the SMR Jun-2026 Release 1 version have security vulnerabilities. These vulnerabilities stem from improper handling of insufficient...

EUVD-2026-33550

An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affected. This issue affects OTRS: 7.0.X...

CVE-2026-48190 Incorrect handling of permissions in External Interface Config Item List module

An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to be affected. This issue affects OTRS: 7.0.X...

CVE-2026-48191

CVE-2026-48191 affects STORM modules in OTRS (versions 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x prior to 2026.4.x). The vulnerability arises from incorrect handling of permissions in Document Search Article Meta Filters, enabling an attacker to learn the number of affected CIs, SLA and se...