Total
129 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-78230 | 2026-09-08 | N/A | N/A | ||
| AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_ai: from 0.1.0 before 1.0.3. | |||||
| CVE-2026-78216 | 2026-09-08 | N/A | N/A | ||
| AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_lua: from 0.1.0 before 0.2.2. | |||||
| CVE-2026-15431 | 2026-09-08 | N/A | N/A | ||
| A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls. | |||||
| CVE-2026-14613 | 1 Redhat | 1 Build Of Keycloak | 2026-08-31 | N/A | 4.3 MEDIUM |
| A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information. | |||||
| CVE-2026-39363 | 2 Vitejs, Voidzero | 2 Vite, Vite\+ | 2026-08-25 | N/A | 7.5 HIGH |
| Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5. | |||||
| CVE-2026-41326 | 1 Katacontainers | 2 Confidential Containers, Kata Containers | 2026-08-24 | N/A | 8.2 HIGH |
| Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an oversight in the CopyFile policy (and perhaps the CopyFile handler) allows untrusted hosts to write to arbitrary locations inside the guest workload image. This can be used to overwrite binaries inside the guest and exfiltrate data from containers; even those running inside CVMs. This vulnerability is fixed in v3.29.0. | |||||
| CVE-2025-20628 | 2026-07-24 | N/A | N/A | ||
| An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode. | |||||
| CVE-2026-33825 | 1 Microsoft | 1 Defender Antimalware Platform | 2026-07-24 | N/A | 7.8 HIGH |
| Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-55006 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-07-24 | N/A | 7.8 HIGH |
| Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-48581 | 1 Microsoft | 54 Surface Go 2 1901, Surface Go 2 1901 Firmware, Surface Go 2 1926 and 51 more | 2026-07-24 | N/A | 7.8 HIGH |
| Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-9088 | 2026-07-23 | N/A | 2.7 LOW | ||
| A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure. | |||||
| CVE-2026-16560 | 2026-07-22 | N/A | 5.3 MEDIUM | ||
| A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation. | |||||
| CVE-2026-50502 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 8.0 HIGH |
| Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-50405 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 7.8 HIGH |
| Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-49170 | 1 Microsoft | 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-07-22 | N/A | 7.8 HIGH |
| Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2021-46747 | 2026-07-22 | N/A | N/A | ||
| Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (System Management Network) apertures leading to a potential escalation of privileges. | |||||
| CVE-2026-2651 | 1 Lfprojects | 1 Mlflow | 2026-07-21 | N/A | 9.0 CRITICAL |
| A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0. | |||||
| CVE-2024-13272 | 1 Paragraphs Table Project | 1 Paragraphs Table | 2026-07-21 | N/A | 6.3 MEDIUM |
| Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2. | |||||
| CVE-2026-56155 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-07-15 | N/A | 7.8 HIGH |
| Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-69196 | 1 Jlowin | 1 Fastmcp | 2026-07-15 | N/A | 6.5 MEDIUM |
| FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2. | |||||