484 matches found
CVE-2023-33246
CVE-2023-33246 - RocketMQ Remote Code Execution CVE-2023-33246 - Apache RocketMQ config Remote Code Execution Exploit Overview RocketMQ is a distributed messaging and streaming platform. RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is...
COOL cool-admin-midway Authorization Issue Vulnerability
COOL cool-admin-midway versions 8.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper permission verification. An attacker with the 'sys:user:' permission can call the '/admin/sys/user/info', '/update', or '/delete' interfaces. By providing arbitrary...
Mistral AI Mistral Vibe processing logic error vulnerability
Mistral AI Mistral Vibe versions prior to 2.25.5 have a processing logic vulnerability. This vulnerability stems from differences in the parsing of escaped newline characters by the extractcommands function in bash.py between tree-sitter-bash and bash. As a result, permission verification is...
EUVD-2026-96042
ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface...
CVE-2026-108501 Unauthorized access vulnerability in ZTE Z80 Ultra product
ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface...
CVE-2026-91796
Foxit PDF Editor/Reader is susceptible to an NTLM Response Information Disclosure Vulnerability (CVE-2026-91796) because the interface lacks permission verification for secure reading mode . This flaw enables specially crafted PDFs to trigger external SMB authentication without prompting the user...
EUVD-2026-85126
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials...
PT-2026-97215
Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description The interface lacks permission verification for secure reading mode. This allows a specially crafted PDF to trigger external SMB Server Message Block authentication without...
WordPress TranslatePress plugin has a privilege escalation vulnerability
The WordPress TranslatePress plugin is a multilingual translation plugin for WordPress. The TranslatePress plugin has a vulnerability related to permission escalation. This vulnerability stems from improper permission verification, allowing attackers to escalate their privileges without being...
CVE-2026-12274
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...
CVE-2026-47366
Improper verification of access permissions when modifying permissions through the Administration Control Panel ACP allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface...
PT-2026-48820
Improper verification of access permissions when modifying permissions through the Administration Control Panel ACP allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface...
Fortinet FortiPortal access control vulnerability (CNVD-2026-25588)
Fortinet FortiPortal is a network security management portal product that primarily provides features such as network visualization, configuration management, and security policy monitoring. Fortinet FortiPortal has a access control vulnerability. This vulnerability stems from an inability to...
CVE-2026-41950
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit...
Lenovo Software Fix security vulnerabilities
Lenovo Software Fix is a system repair tool developed by the Chinese company Lenovo. Lenovo Software Fix has a security vulnerability, which stems from improper permission verification during the installation process. This vulnerability may allow locally authenticated users to execute write...
AVEVA Pipeline Simulation security vulnerabilities
AVEVA Pipeline Simulation is a pipeline simulation software developed by AVEVA, a British company. AVEVA Pipeline Simulation has a security vulnerability. This vulnerability stems from improper permission verification, which may allow unverified attackers to perform privileged operations, resulti...
Lenovo Software Fix security vulnerabilities
Lenovo Software Fix is a system repair tool developed by the Chinese company Lenovo. Lenovo Software Fix has a security vulnerability, which stems from improper permission verification during the installation process. This vulnerability may allow locally authenticated users to execute code with...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient verification of user permissions in the redirects process. An attacker can gain unauthorized access to redirect records by editing a page without proper access controls. Remediation Upgrade...
Craft CMS security vulnerability
Craft CMS is an open-source content management system developed by Craft CMS. Versions prior to Craft CMS 5.9.0-beta.1 and 4.17.0-beta.1 contained security vulnerabilities. These vulnerabilities stemmed from a lack of permission verification during repeated entry operations, which could allow...
