Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
CVE-2026-108724
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmode
#cwe-639
共收录 1905 条相关情报。
← 返回所有主题LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php
CVE-2026-108715
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_managemen...
CVE-2026-108574
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs
BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization
CVE-2026-108574
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other us...
CVE-2026-104684
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before re
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged...
CVE-2026-108704
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that...
CVE-2026-108696
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated c
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows...
CVE-2026-108689
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write in
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to the...
CVE-2026-108704
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying u...
CVE-2026-108696
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated c
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrar...
CVE-2026-108689
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write in
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords...
CVE-2026-108672
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGeneration
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in...
CVE-2026-108642
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows auth
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows...
CVE-2026-108641
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to re
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows...
CVE-2026-108608
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to de
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows...
CVE-2026-108607
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to de
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows...
CVE-2026-108609
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to re
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other ...
CVE-2026-108672
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGeneration
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery r...
CVE-2026-108642
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows auth
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne ha...
CVE-2026-108641
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to re