5884 matches found
CVE-2026-108165
Versions of Immich through 3.3.1 are vulnerable to a missing authorization flaw in the partner synchronization stream. The root cause is that synchronization queries fail to exclude Locked visibility, allowing authenticated partners to access Locked Folder asset metadata. An attacker with an acti...
CVE-2026-108165 Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...
CVE-2026-108165 Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...
CVE-2026-98319
A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem. An error handling failure during display synchronization processing prevents allocated event memory from being released when an operation fails. A local user can exploit this vulnerability by submitting specific displa...
PT-2026-109651
Name of the Vulnerable Software and Affected Versions Immich versions prior to 3.3.2 Description A missing authorization issue exists in the partner synchronization stream. Authenticated partners can access metadata for assets within the Locked Folder because synchronization queries fail to exclu...
CVE-2026-108165: Missing Authorization
Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...
CVE-2026-98228
A flaw was found in the Linux kernel's MIPS architecture support for Mobileye EyeQ platforms. On affected systems, atomic operations lack required memory synchronization barriers, which allows the processor to improperly reorder memory access. A local user can exploit this race condition through...
EUVD-2026-95895
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...
CVE-2026-92989
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...
CVE-2026-92989: Improper Access Control
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...
ROS-20261009-73-0427
The vulnerability in the core/ufshcd.c component of the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20261009-73-0283
The vulnerability of the drivers/md/md-bitmap.c component in the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20261009-73-0181
The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20261009-73-0208
The vulnerability of the drivers/mfd/mfd-core.c component in the Linux operating system is related to the lack of synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20261009-73-0068
The vulnerability of the rpmsg/rpmsgcore.c component in the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...
Apache Tomcat Synchronization Data Compromise
The vulnerability of the Apache Tomcat application server is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
tomcat-cluster-session-sync-exp
Lo strumento è destinato esclusivamente alla ricerca di sicurezza e all'auto-verifica interna; è vietato utilizzarlo per lanciare attacchi illegali. Le conseguenze derivanti da un uso improprio sono a carico dell'utente. Exploit per la sincronizzazione di sessione del cluster tomcat Questa è una...
ROS-20261008-73-0281
The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...