Netty: Security Control Bypass via CORS Short-Circuit Failure
CVE-2026-56746
### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin r
#cwe-284
共收录 1981 条相关情报。
← 返回所有主题User tags, filters and conditions allowed access to insufficiently restricted user fields....
CVE-2026-64794
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose
Free did not require both the article creator and last modifier to be Super Users before...
CVE-2026-64796
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching...
CVE-2026-63265
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissio
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and P...
CVE-2026-64796
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restr...
CVE-2026-64794
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose
Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who ...
CVE-2026-64793
Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A con
Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF...
CVE-2026-64791
Administrator routes and install/update/uninstall processing did not consistently enforce component-management and insta
Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform dat...
CVE-2026-63685
Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An u
Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks ...
CVE-2026-63684
Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-valid
Conditions administration did not consistently enforce tokens and component/mapped-item permissions.
CVE-2026-63280
Conditions administration did not consistently enforce tokens and component/mapped-item permissions.
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authe...
CVE-2026-63265
Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissio
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
CVE-2026-63047
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, al...
CVE-2026-14322
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created throug
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install). Supported versions that are affec...
CVE-2026-62574
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vu...
CVE-2026-62567
Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions th
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End). Supported versions that are affected are 12.2.3-12.2.15. Easily explo...
CVE-2026-62565
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End). Supported ve
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily explo...
CVE-2026-62562
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily e...
CVE-2026-62560
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supporte
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily explo...
CVE-2026-62559
Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported ve