Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA ...
CVE-2026-94578
Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Author
#cwe-269
共收录 809 条相关情报。
← 返回所有主题An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation...
CVE-2026-87681
An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabri
Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access...
CVE-2026-106492
Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaul
In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with Syst...
CVE-2026-55307
In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code.
Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restriction...
CVE-2026-106296
Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveragi
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource rec...
CVE-2026-67269
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulner
Nx daemon and plugin worker sockets are accessible to other local users
CVE-2026-104854
## Summary Nx creates the Unix domain sockets for its daemon and its plugin workers in a shared temporary directory wit
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to ass...
CVE-2026-105688
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation ac
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but ...
CVE-2026-105687
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team admi
Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contribu...
CVE-2026-105678
Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role
In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privileg...
CVE-2026-58841
In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in
In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil...
CVE-2026-28647
In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error i
In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to ...
CVE-2026-28641
In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission byp
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution priv...
CVE-2026-28625
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local
Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST...
CVE-2026-105634
Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows a
Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
CVE-2026-105634
Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows a
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/...
CVE-2026-104955
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request
Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
CVE-2026-104955
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows...
CVE-2026-105126
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. ...
CVE-2026-105126
LaraDashboard 是一款基于 Laravel 的后台管理面板。在 1.4.8 版本之前，存在不正确的权限管理漏洞。经过身份验证的 Admin 用户（拥有 role.edit 权限）可以通过编辑或重命名角色来提升权限。具体而言，攻击