421 matches found
CVE-2026-91796
Foxit PDF Editor/Reader is susceptible to an NTLM Response Information Disclosure Vulnerability (CVE-2026-91796) because the interface lacks permission verification for secure reading mode . This flaw enables specially crafted PDFs to trigger external SMB authentication without prompting the user...
EUVD-2026-85126
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials...
CVE-2023-33246
CVE-2023-33246 - RocketMQ リモートコード実行 CVE-2023-33246 - Apache RocketMQ 設定によるリモートコード実行エクスプロイト 概要 RocketMQ は分散型メッセージングおよびストリーミングプラットフォームです。 RocketMQ バージョン 5.1.0 以下は、任意のコードインジェクションに対して脆弱です。RocketMQ の Broker コンポーネントが外部ネットワークに漏洩し、アクセス許可の検証が不足しています。攻撃者は設定更新機能を利用して、RocketMQ...
WordPress TranslatePress plugin has a privilege escalation vulnerability
The WordPress TranslatePress plugin is a multilingual translation plugin for WordPress. The TranslatePress plugin has a vulnerability related to permission escalation. This vulnerability stems from improper permission verification, allowing attackers to escalate their privileges without being...
CVE-2026-12274
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...
CVE-2026-47366
Improper verification of access permissions when modifying permissions through the Administration Control Panel ACP allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface...
PT-2026-48820
Improper verification of access permissions when modifying permissions through the Administration Control Panel ACP allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface...
Fortinet FortiPortal access control vulnerability (CNVD-2026-25588)
Fortinet FortiPortal is a network security management portal product that primarily provides features such as network visualization, configuration management, and security policy monitoring. Fortinet FortiPortal has a access control vulnerability. This vulnerability stems from an inability to...
CVE-2026-41950
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit...
Lenovo Software Fix 安全漏洞
Lenovo Software Fix is a system repair tool developed by the Chinese company Lenovo. Lenovo Software Fix has a security vulnerability, which stems from improper permission verification during the installation process. This vulnerability may allow locally authenticated users to execute write...
AVEVA Pipeline Simulation 安全漏洞
AVEVA Pipeline Simulation is a pipeline simulation software developed by AVEVA, a British company. AVEVA Pipeline Simulation has a security vulnerability. This vulnerability stems from improper permission verification, which may allow unverified attackers to perform privileged operations, resulti...
Lenovo Software Fix 安全漏洞
Lenovo Software Fix is a system repair tool developed by the Chinese company Lenovo. Lenovo Software Fix has a security vulnerability, which stems from improper permission verification during the installation process. This vulnerability may allow locally authenticated users to execute code with...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient verification of user permissions in the redirects process. An attacker can gain unauthorized access to redirect records by editing a page without proper access controls. Remediation Upgrade...
Craft CMS 安全漏洞
Craft CMS is an open-source content management system developed by Craft CMS. Versions prior to Craft CMS 5.9.0-beta.1 and 4.17.0-beta.1 contained security vulnerabilities. These vulnerabilities stemmed from a lack of permission verification during repeated entry operations, which could allow...
CVE-2025-68959
Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2025-68970
Technical details (affected products, versions, exploit vectors, and fixes) are not publicly provided in the supplied documents. Monitor for forthcoming updates from vendors and security advisories.
CVE-2025-68970: Improper Input Validation
Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
PT-2026-2575
Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2025-68959: Exposure of Sensitive Information to an Unauthorized Actor
Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
