CVE-2026-107350

A flaw was found in PgBouncer. An improper authentication vulnerability allows a remote attacker possessing valid credentials for any listed user to impersonate any other user configured with Salted Challenge Response Authentication Mechanism SCRAM, including PgBouncer administrators and backend...

EUVD-2026-98079

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication...

CVE-2026-19620 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication...

CVE-2026-85950

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized...

CVE-2026-85950 Improper privilege management in Progress MarkLogic Server REST extensions

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized...

EUVD-2026-97509

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized...

CVE-2026-85950: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized...

PT-2026-95958

Name of the Vulnerable Software and Affected Versions NivoCart versions prior to 2.4.1 Description The 'forgotten.php' endpoint generates recovery codes using the substrmd5mt rand, 0, 10 method, resulting in predictable password reset tokens. An attacker with knowledge of an administrator's email...

CVE-2026-84400: Missing Authentication for Critical Function

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of...

PT-2026-95479

Name of the Vulnerable Software and Affected Versions CareCam CM2507 affected versions not specified Description An insufficiently protected network maintenance mechanism allows for the activation of a remote debugging service. An attacker located on the same local network who meets specific devi...

CVE-2026-14837: Improper Verification of Cryptographic Signature

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

Improper Privilege Management

Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to Improper Privilege Management via the upsertUser function. An attacker can gain unauthorized administrative privileges by creating or updating user accounts with elevated permissions...

CVE-2016-15058: Storing Passwords in a Recoverable Format

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is...

Edimax GS-5008PL 安全漏洞

The Edimax GS-5008PL is a Gigabit Ethernet switch produced by Edimax of Taiwan, China. Versions of the Edimax GS-5008PL prior to 1.00.54 contained security vulnerabilities. These vulnerabilities stemmed from insecure credential storage, allowing attackers to obtain administrator credentials by...

CVE-2025-52392

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to...

CVE-2025-0674: Authentication Bypass Using an Alternate Path or Channel

Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system. This grants them unauthorized...

Dcastalia CMS 1.2 Insecure Direct Object Reference

==================================================================================================================================== | Title : Dcastalia CMS v1.2 Unauthorized administrative access Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

CVE-2022-22487: Improper Restriction of Excessive Authentication Attempts

An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain...

IBM Spectrum Protect 授权问题漏洞

IBM Spectrum Protect is a suite of data protection platforms from IBM Corporation in the United States. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect...

PHP-Coolfile 1.4 Unauthorized Administrative Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9018/info PHP-Coolfile allows unauthorized administrative access due to an error in the way access is evaluated in the action.php file. This could allow a remote user to obtain the administrative username and password for...