The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure...
CVE-2026-17538
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference
#cwe-639
共收录 1905 条相关情报。
← 返回所有主题Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
CVE-2026-105698
### Summary Before **Langflow 1.10.1**, two deprecated but still-routed endpoints in the chat API did not check that th
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
CVE-2026-105699
### Summary Langflow's project-scoped MCP transport authenticates the caller for the `project_id` in the connection URL,
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain...
CVE-2026-93678
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CVE-2026-93678
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue....
CVE-2026-105268
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also a
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook...
CVE-2026-105811
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lam
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples...
CVE-2026-105811
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lam
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that referenc...
CVE-2026-103009
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the...
CVE-2026-102406
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In th
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, t...
CVE-2026-102157
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authen
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticat...
CVE-2026-106100
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 a
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticat...
CVE-2026-105867
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 a
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a...
CVE-2026-105859
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions befo
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a col...
CVE-2026-105847
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary ve
Payload: Polymorphic join queries could disclose hidden fields
CVE-2026-105847
### Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values,
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of ...
CVE-2026-87975
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseMo
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to...
CVE-2026-105836
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRo
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
CVE-2026-39756
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
Customer Insecure Direct Object References (IDOR) in Faktur Pro for WooCommerce <= 3.2.1 versions.
CVE-2026-32576
Customer Insecure Direct Object References (IDOR) in Faktur Pro for WooCommerce <= 3.2.1 versions.