Twenty: Field-level read bypass
CVE-2026-85055
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission i
#cwe-285
共收录 628 条相关情报。
← 返回所有主题In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification branch did not include the User.disabl...
CVE-2026-95754
In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentica
MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction
CVE-2026-95805
A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action t
MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-95754
In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentica
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However,...
CVE-2026-95671
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element cap
MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
CVE-2026-95671
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element cap
Improper authorization leads to Remote Code Execution via SocketIO interface.
CVE-2026-25254
Improper authorization leads to Remote Code Execution via SocketIO interface.
MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation exists b...
CVE-2026-79917
MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{
A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/...
CVE-2026-93961
CVE-2026-93961 披露了 Dromara UJCMS 内容管理系统（版本至 12.3.1，含 12.3.1）中的一个不当授权（Improper Authorization）缺陷。受影响的具体组件为 ujcms-cms/src/m
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this...
CVE-2026-93955
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the functio
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected...
CVE-2026-93954
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSet
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/...
CVE-2026-93955
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the functio
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/mai...
CVE-2026-93954
A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSet
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions...
CVE-2026-84241
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authoriz
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security...
CVE-2026-84036
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to imp
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security...
CVE-2026-84076
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to imp
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
CVE-2026-84241
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authoriz
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.
CVE-2026-84076
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to imp
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.
CVE-2026-84036
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to imp
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agen...
CVE-2026-77239
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes