kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
CVE-2026-100351
## Summary `openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's legacy router, which sel
#cwe-289
共收录 19 条相关情报。
← 返回所有主题social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
CVE-2026-57176
### Impact The Vend OAuth2 backend used only the numeric Vend `user_id` as the social-auth UID. When multiple Vend sho
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
CVE-2026-95514
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache T...
CVE-2026-76183
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocke
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path,...
CVE-2026-73511
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4,
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt...
CVE-2026-92579
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
CVE-2026-12101
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to i
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to...
CVE-2026-15980
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5.
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() ...
CVE-2026-15980
CVE-2026-15980 是 MyHome Core WordPress 插件中的一个高危身份验证绕过漏洞，影响所有版本直至并包括 4.4.5。漏洞根因在于 send_link() AJAX 处理器缺少权限检查，以及 activate(
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all...
CVE-2026-8457
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and inc
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login han...
CVE-2026-8457
CVE-2026-8457 影响 WooCommerce Social Login 插件（WordPress）所有版本直至 2.8.7。该插件为 WooCommerce 提供社交登录功能，其中苹果登录处理器存在严重认证绕过漏洞。漏洞根源在于
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the pas...
CVE-2026-9701
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and includ
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chai...
CVE-2026-55075
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
CVE-2026-55075
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
CVE-2026-55075
### Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linki
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar ...
CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to ...
CVE-2026-50627
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tok
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's...
CVE-2026-43617
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Att...
CVE-2026-43617
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access