Base de CVEs

CVE-2025-15619 Baixa · 3.5 CWE-284 23/06/2026

HCL Connections is vulnerable to broken access control

HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.

CVE-2026-28381 Alta · 8.1 CWE-284 22/06/2026

Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

CVE-2026-56253 Alta · 7.5 CWE-284 21/06/2026

Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.

CVE-2026-56082 Alta · 7.5 CWE-284 19/06/2026

Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC

Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase publishable (sb_publishable_*) anon key. An unauthenticated attacker can insert rows into public.build_logs for arbitrary organizations and, because the function uses ON CONFLICT (build_id, org_id) DO UPDATE, can overwrite existing usage/billing records by reusing the same build_id for a target org. This enables cross-tenant tampering of billing build logs and financial-impact denial of service by inflating billable build time.

CVE-2026-4027 Alta · 7.1 CWE-284 19/06/2026

FlexNet Manager Suite Attachment File Disclosure

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control.

CVE-2026-4026 Alta · 8.7 CWE-284 19/06/2026

FlexNet Manager Suite Privilege Escalation Vulnerability

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings to escalate their privileges to Administrator level.

CVE-2026-46461 Alta · 7.8 CWE-284 19/06/2026

Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control...

Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVE-2026-47647 Crítica · 9.9 CWE-284 18/06/2026

Microsoft Dynamics 365: controle de acesso inadequado permite elevação de privilégios (CVE-2026-47647)

Controle de acesso inadequado no Microsoft Dynamics 365 permite que um atacante autorizado eleve privilégios pela rede.

CVE-2026-46699 Alta · 7.6 CWE-284 18/06/2026

conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue.

CVE-2026-48617 Alta · 8.2 CWE-284 18/06/2026

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`...

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-2026-54533 Média · 6.9 CWE-284 17/06/2026

vantage6 node has an Improper Access Control issue

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms input and output files. Version 5.0.0 fixes the issue. As a workaround, verify and restrict the algorithm containers that are allowed to run on the node.

CVE-2026-35162 Média · 6.5 CWE-284 17/06/2026

Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

CVE-2026-35067 Alta · 8.0 CWE-284 17/06/2026

Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.

CVE-2026-35066 Alta · 7.1 CWE-284 17/06/2026

Dell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

CVE-2025-66391 Alta · 8.8 CWE-284 17/06/2026

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the…

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker attempts to reset the password of a user account.

CVE-2026-48616 Crítica · 9.3 CWE-284 17/06/2026

Falha de controle de acesso em downloads de arquivos do Livechat no Rocket.Chat

O Rocket.Chat nas versões <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 apresenta uma falha de controle de acesso em arquivos do Livechat. Os downloads protegidos de arquivos em /file-upload/:fileId/:name autorizam o acesso ao Livechat usando rc_room_type=l com rc_rid+rc_token, mas o caminho de autorização não verifica se rc_rid corresponde ao rid do arquivo solicitado. Além disso, :fileId é previsível por meio de IDs sequenciais do MongoDB, e :name pode ser qualquer valor, permitindo a descoberta não autenticada de todos os arquivos enviados.

CVE-2026-12460 Média · 4.2 CWE-284 17/06/2026

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155...

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: High)

CVE-2026-46979 Média · 6.5 CWE-284 17/06/2026

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft ...

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and Interfaces). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

CVE-2026-46978 Crítica · 10.0 CWE-284 17/06/2026

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration...

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

CVE-2026-46976 Alta · 7.2 CWE-284 17/06/2026

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component:...

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46974 Alta · 7.5 CWE-284 17/06/2026

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-46969 Alta · 7.2 CWE-284 17/06/2026

Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component:...

Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Financials for EMEA. Successful attacks of this vulnerability can result in takeover of Oracle Financials for EMEA. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46967 Alta · 8.8 CWE-284 17/06/2026

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business...

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials (International). CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46965 Alta · 8.8 CWE-284 17/06/2026

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component:...

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46963 Crítica · 9.9 CWE-284 17/06/2026

Oracle Universal Work Queue - Controle de acesso inadequado

Vulnerabilidade no produto Oracle Universal Work Queue do Oracle E-Business Suite (componente: Work Provider Site Level Administration). As versoes suportadas afetadas sao 12.2.3-12.2.15. Vulnerabilidade facilmente exploravel permite que um atacante com privilegios baixos e acesso a rede via HTTP comprometa o Oracle Universal Work Queue. Embora a vulnerabilidade esteja no Oracle Universal Work Queue, ataques podem impactar significativamente produtos adicionais (mudanca de escopo). Ataques bem-sucedidos desse tipo podem resultar na tomada de controle do Oracle Universal Work Queue. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).