webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

PT-2026-80900

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications...

CVE-2025-50675-GPMAW-Permissions

CVE-2025-50675 – Unsichere Berechtigungen in GPMAW 14.2 Zusammenfassung CVE-2025-50675 betrifft GPMAW 14.2, eine von Lighthouse Data entwickelte Bioinformatik-Software. Der Installer erstellt den Ordner C:\Program Files\gpmaw mit vollständiger Kontrolle für die Gruppe 'Jeder' , sodass jeder lokal...

CVE-2026-76607

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-59292

CVE-2026-59292...

EUVD-2026-64174

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047

Combodo iTop (a web-based IT service management tool) is affected by a permission bypass in versions prior to 3.2.3 . A user without write permissions can lock an object, which may disrupt other users' ability to modify that object. The CVSS 3.1 score is 4.3 (MEDIUM) , reflecting a low availabili...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2025-68721

CVE-2025-68721: Controllo degli accessi non corretto in Axigen WebAdmin Riepilogo della vulnerabilità Un difetto nella logica delle autorizzazioni consente a un account amministratore con zero permessi di accedere alla pagina "Sicurezza e Filtraggio", in particolare all'endpoint dei Certificati...

CVE-2026-14208 Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-14208

Remote Utilities Host versions up to 7.7.3.0 contain a local privilege escalation vulnerability caused by insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\). The BUILTIN\Everyone group is granted FULL CONTROL , allowing any local unprivi...

BIT-GRAFANA-2026-11817 CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-66722

CVE-2026-66722 is an improper authorization flaw in Apache CloudStack affecting versions 4.15.0.0–4.20.3.0 and 4.21.0.0–4.22.1.0 . The root cause is that CRUD operations on Project Roles and Project Role Permissions only verify the caller is a Domain Admin, without checking whether the target pro...

Perfusion

Perfusion Unter Windows 7 , Windows Server 2008R2 , Windows 8 und Windows Server 2012 ist der Registrierungsschlüssel der Dienste RpcEptMapper und DnsCache nur 7/2008R2 mit schwachen Berechtigungen konfiguriert. Jeder lokale Benutzer kann einen Unterschlüssel Performance erstellen und dann die...

EUVD-2026-63800

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-43679

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...

CVE-2026-43679

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...

CVE-2026-43679

CVE-2026-43679 is a permissions-checking flaw in the FaceTime component of Apple Watch Series 6 and later . An attacker with physical access to a locked Apple Watch may be able to view user contacts. The issue was addressed with improved permissions checking and is fixed in watchOS 26.4 . The vul...

EUVD-2026-63777

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...