287871 matches found
EUVD-2026-75594
A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...
CVE-2026-88959
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...
CVE-2026-88017
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...
CVE-2026-81051
Dell ThinOS 10, versions prior to 260510.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Protection mechanism bypass...
CVE-2026-79987 Low-privilege RCE through element-search eager loading
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
CVE-2026-79987 Low-privilege RCE through element-search eager loading
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...
CVE-2026-79987
CVE-2026-79987 is a low-privilege remote code execution vulnerability in Craft CMS , exploitable by a remote, authenticated, non-admin Control Panel user holding only the accessCp permission. The root cause involves element-search eager loading , allowing the attacker to execute operating system ...
EUVD-2026-75572
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...
CVE-2026-88959
Anchor CMS through 0.12.7 contains a privilege escalation vulnerability caused by missing role-based access control (RBAC) on admin user-management endpoints. Any authenticated user with editor or user roles can send POST requests directly to the admin/users/add or admin/users/edit endpoints to c...
CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...
CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...
CVE-2026-81049
Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Missing Support for Integrity Check vulnerability. A high-privileged attacker with local access can potentially exploit this flaw to achieve arbitrary code execution . The CVSS 3.1 score is 4.4 (MEDIUM) , with the primary impac...
CVE-2026-4129 Improper Access Controls in NI SystemLink
There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026...
CVE-2026-4129
NI SystemLink and NI SystemLink Server (versions 2026 Q3 and prior) contain an improper access control vulnerability that allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The CVSS 3.1 score is 8.1 (HIGH) with hig...
CVE-2026-81051
Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Security Version Number Mutable to Older Versions vulnerability. A low-privileged attacker with physical access can potentially exploit this flaw to bypass the system's protection mechanism, resulting in high impact across conf...
DEBIAN-CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
CVE-2026-88006
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...