gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
CVE-2026-84303
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/
#cwe-863
共收录 2104 条相关情报。
← 返回所有主题Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of pri...
CVE-2026-58566
Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentiall
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted ...
CVE-2026-84206
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allo
Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
CVE-2026-84206
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allo
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory...
CVE-2026-74994
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multipl
Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administr...
CVE-2026-76111
Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could p
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read policy...
CVE-2026-82747
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary Fil...
CVE-2026-75921
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot b...
CVE-2026-82749
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match uni
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies th...
CVE-2026-82748
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing i
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82747
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
CVE-2026-82749
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match uni
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
CVE-2026-82748
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing i
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field poli...
CVE-2026-82730
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute
Authorization-redacted field values disclosed through AshTypescript result normalization
CVE-2026-82730
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check fro...
CVE-2026-82395
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8,
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBun...
CVE-2026-82394
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8,
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap...
CVE-2026-80204
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTa
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(),...
CVE-2026-80202
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard rou...
CVE-2026-81892
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin s