CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910: Incorrect Privilege Assignment

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-67846-BOOM-NBDTLB

CVE-2026-67846: Assegnazione errata dei privilegi in BOOM NBDTLB ID CVE CVE-2026-67846 Panoramica La Berkeley Out-of-Order Machine BOOM al commit 5223e44cfeb26f41380057a2eb4d651197475f69 contiene un potenziale problema di assegnazione errata dei privilegi nelle implementazioni NBDTLB v3 e v4. Il...

CVE-2026-75978: Incorrect Privilege Assignment

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues...

ROS-20260819-73-0003

The vulnerability in gobgp is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0036

A vulnerability in Mariadb 11.8 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0033

The vulnerability in Mariadb is related to the incorrect assignment of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20260818-73-0034

A vulnerability in Mariadb 10.6 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260818-73-0035

A vulnerability in Mariadb 11.4 is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2026-67846: Incorrect Privilege Assignment

Berkeley Out-of-Order Machine BOOM commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE...

CVE-2026-67846

Berkeley Out-of-Order Machine BOOM commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE...

CVE-2026-72826: Incorrect Privilege Assignment

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

Incorrect Privilege Assignment

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the process that issues API keys to agents enrolled in integration policies with extra data...

CVE-2026-72839: Incorrect Privilege Assignment

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...

CVE-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2025-9486: Incorrect Privilege Assignment

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE GitLab Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE Authorizatio...

CVE-2026-19376: Incorrect Privilege Assignment

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been...