Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-49805
Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.
#cwe-284
共收录 1981 条相关情报。
← 返回所有主题Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (...
CVE-2026-57855
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php execut...
CVE-2026-57855
Cockpit CMS 存在一个授权缺失漏洞（CVE-2026-57855），位于 Bucket 文件存储 API（/system/buckets/api）中。在 modules/System/Controller/Buckets.php
Cockpit CMS Missing Authorization in Bucket File Storage API
CVE-2026-57855
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical ...
CVE-2026-51538
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of en
DIRAC: SQL injection and lack of access control in PilotManager service
### Details A number of the functions in PilotManager pass parameters directly through to the database layer, which then
A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the compone...
CVE-2026-15539
A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown functi
A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the compon...
CVE-2026-15530
A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the fi
A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the...
CVE-2026-15518
A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryControl
A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/Fil...
CVE-2026-15518
A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryControl
A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function...
CVE-2026-15488
A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of t
A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executi...
CVE-2026-15488
A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of t
hcr707305003 shiroiAdmin FileController.php upload unrestricted upload
CVE-2026-15488
A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of t
A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver....
CVE-2026-15476
CVE-2026-15476 影响 QILING Disk Master 6.0.0.0 版本，涉及内核驱动程序 diskbckp.sys 中的一个未知函数。该漏洞允许具有本地访问权限的攻击者利用不当的访问控制机制，可能导致部分机密性、完整
A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Kernel Dri...
CVE-2026-15475
MiniTool Partition Wizard 至 13.6 版本中存在一个本地权限提升漏洞。该漏洞源于其签名内核驱动组件中的 pwdrvio.sys 库，具体位于未知函数中，由于不当的访问控制导致攻击者能够在本地利用该漏洞。攻击者需要
The charging station websocket endpoint accepts connections without proper authentication, which...
CVE-2026-20744
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privileg
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.
CVE-2026-20744
该漏洞影响充电站系统的WebSocket端点。由于缺乏适当的身份验证，任何能够访问该端点的攻击者均可建立连接，进而可能利用该通道执行未经授权的操作。CVSS 3.1评分为9.8（严重），表明攻击者无需身份验证即可远程利用该漏洞，且攻击复杂度
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, c...
CVE-2026-55670
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by ...
CVE-2026-56335
Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate pro
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authentica...
CVE-2026-40452
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLas