Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any...
CVE-2026-108854
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user
#cwe-639
共收录 1905 条相关情报。
← 返回所有主题UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows...
CVE-2026-108856
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking:...
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variabl...
CVE-2026-108879
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows
JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter
CVE-2026-108879
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflo...
CVE-2026-108864
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a fore...
CVE-2026-108862
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspa...
CVE-2026-108856
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a num...
CVE-2026-108854
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG appli...
CVE-2026-108853
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-pri
iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint
CVE-2026-108864
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated
APIPark through 1.9.7-beta IDOR via application authorization endpoints
CVE-2026-108862
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to
UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting
CVE-2026-108856
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppK
Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key
CVE-2026-108854
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user
UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app
CVE-2026-108853
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-pri
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplyin...
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplyin...
CVE-2026-108747
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedEx...
CVE-2026-108724
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmode
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered ...
CVE-2026-108715
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php
Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
CVE-2026-108758
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth