76 matches found
CVE-2026-70411
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
CVE-2026-70411
Dell Container Storage Modules (CSM) versions prior to 1.18.0 are vulnerable to a Missing Authentication for Critical Function vulnerability within the csm-authorization-tenant gRPC service (TenantService) . An unauthenticated attacker positioned on an adjacent network could exploit this flaw to ...
EUVD-2026-93461
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
CVE-2026-70411
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
CVE-2026-86135
A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...
EUVD-2026-72790
A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...
PT-2026-87104
A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
CVE-2026-72531
Joomla! Core - 20260804 - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components...
PT-2026-77194
Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description Improper Access Control List ACL checks in custom fields webservice endpoints allow unauthorized users to create fields for components they should...
PT-2026-69975
Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.111.0 ERPNext versions prior to 16.22.0 Description The add ac function in erpnext/accounts/utils.py accepts the ignore permissions argument without enforcing the required Account create permission. This allows an...
CVE-2026-63741
SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and...
CVE-2026-48958 Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints
An improper access check allows unauthorized users to create custom fields via webservices endpoints...
GHSA-22VX-2X23-98W6 OpenSearch vulnerable to improper authorization for Rollover Requests
Description A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user wit...
CVE-2026-4292
A flaw was found in Django. Admin changelist forms utilizing ModelAdmin.listeditable were susceptible to improper access control. A remote attacker could exploit this by sending forged POST data, leading to the unauthorized creation of new instances within the application. Mitigation Mitigation f...
WordPress Social Icons Widget & Block plugin <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation vulnerability
Missing Authorization to Authenticated Subscriber+ Sharing Configuration Creation vulnerability discovered by darkmode in WordPress Plugin Social Icons Widget & Block by WPZOOM versions = 4.5.8...
Zabbix 6.0.x < 6.0.41 / 7.0.x < 7.0.18 / 7.4.x < 7.4.2 Unauthorized Object Creation (ZBX-27567)
The version of Zabbix installed on the remote host is affected by an authorization bypass vulnerability. An authenticated low-privilege user User role possessing template and host write permissions can exploit the configuration.import API to create unauthorized objects, despite the User role...
PT-2026-6202
Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2 Description The Open eClass platform, previously known as GUnet eClass, is a course management system. A broken access control issue permits authenticated students to create new course units, a function...
CVE-2025-13753 WP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the savetable function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with...