119535 matches found
CVE-2026-62836
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-56162
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-70332
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-62918
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-62836
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-67621
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...
CVE-2026-53983
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...
CVE-2025-12317
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...
CVE-2026-47765
CVE-2026-47765 (Frappe) : A permissions check gap exists in the restore and bulk_restore endpoints of Frappe prior to versions 15.110.0 and 16.20.0, allowing an authenticated user to restore deleted documents without proper authorization. The issue is fixed in those respective versions. Impact is...
CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...
CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...
golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority CA. A remote attacker could potentially exploit this by presenting a revoked key, leading t...
CVE-2026-64662
Summary of CVE-2026-64662 (Statamic) : Statamic, a Laravel and Git powered CMS, had an issue where an authenticated Control Panel user could view content from entries they were not permitted to view, including entry content and custom field values, across any collection and including unpublished ...
CVE-2026-15246
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...
CVE-2026-25403
Affected software: WordPress plugin “Ultimate Store Kit Elementor Addons”
CVE-2026-58043
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories. Mitigation Avoid enabling the Node.js Permission Model by not using the --permission flag when starting Node.js applications. This...
CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...
Copilot Cowork Elevation of Privilege Vulnerability
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network...