2416 matches found
CVE-2026-82272
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...
CVE-2026-82272
Immich versions up to 3.1.0 contain a visibility enforcement flaw: when an asset is locked via the single-asset endpoint , the lock is not correctly applied to shared albums and shared links , allowing a low-privileged attacker to read the asset and its metadata without bypassing any other protec...
CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...
EUVD-2026-67803
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...
SentinelOne-ATTACK-Queries
Query SentinelOne mappate su ATT&CK Query mappate su MITRE ATT&CK per SentinelOne Deep Visiblity NON PIÙ MANTENUTO Questo progetto è stato sostituito dal repositorySentinelOne-Queries, che si orienta verso firme condivisibili e per l'uso negli strumenti. Il nuovo repository è costruito sul lavoro...
LambdaGuard
LambdaGuard AWS Lambda ist eine ereignisgesteuerte, serverlose Computing-Plattform von Amazon Web Services. Es ist ein Computing-Dienst, der Code als Reaktion auf Ereignisse ausführt und automatisch die für diesen Code erforderlichen Rechenressourcen verwaltet. LambdaGuard ist ein AWS...
CVE-2026-81684
openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 contain an information disclosure flaw in its desktop GUI. The steganography password is passed to a CLI child process via the --stego-password command-line argument (on both encrypt and decrypt paths) rather than through an environme...
Linux Distros Unpatched Vulnerability : CVE-2026-7485
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted ho...
CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...
CVE-2026-58437
A flaw was found in Gitea. This vulnerability allows an attacker to manipulate repository visibility settings by leveraging specific Git push options. This could lead to unauthorized disclosure of repository information or unintended access control changes. Mitigation Mitigation for this issue is...
CVE-2026-7485
Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see...
EUVD-2026-63321
Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see...
EUVD-2026-63129
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...
PT-2026-79058
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom field project attribute. The dialog path resolves the project custom field by its raw identifier without...
CVE-2026-76322
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...
CVE-2026-76215
phpMyFAQ before 4.1.7 contains an authorization bypass in its comments and attachments API endpoints. The application fails to enforce parent FAQ visibility checks before returning child resources, allowing unauthenticated attackers to retrieve restricted comment text, commenter email addresses, ...
CVE-2026-76215 phpMyFAQ before 4.1.7 Missing Authorization via child resources
phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...
EUVD-2026-62456
phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...
CVE-2026-74906
SiYuan before v3.7.4 incorrectly filters eight publish-mode endpoints (search, backlink, asset content, saved criteria, recent documents, graph, tag) using the visibility list instead of the disabled list, allowing anonymous users to read documents explicitly marked as forbidden from publishing. ...