CWE-863

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an

MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege es

OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is v

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the requir

Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to

Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and man

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and

During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Devi

An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged admin

Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation t

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.6. An app may be able t

NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate perm

An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 th

The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization mod

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on t

In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activ

In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in th

In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic err

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe

ListCheck.exe developed by Acer has a Local Privilege Escalation vulnerability. Authenticated local attackers can replac

Memory corruption while loading an invalid firmware in boot loader.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certa

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` fie

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported ver

An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily swit

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get

An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to

This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you c

Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could all

An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-ma

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In version

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an

rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verific

Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects Civ

Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is ex

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Sig

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the

Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating s

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. F

Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Ba

This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access

A vulnerability was found in withstars Books-Management-System 1.0. It has been rated as critical. Affected by this issu

A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue a

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that c

In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker