KitchenOwl through 0.7.10 IDOR via unchecked category ID
CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati
#cwe-639
共收录 1909 条相关情报。
← 返回所有主题The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not...
CVE-2026-86839
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or...
CVE-2026-92436
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loa
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that...
CVE-2026-92436
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loa
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX act...
CVE-2026-86839
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized...
CVE-2026-72662
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification,
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Prop...
CVE-2026-72662
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification,
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated user...
CVE-2026-100688
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's...
CVE-2026-100679
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypas
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard tha...
CVE-2026-100670
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The ac
Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "...
CVE-2026-100627
Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authentica...
CVE-2026-100626
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that a
Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores i...
CVE-2026-100618
Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a
Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating...
CVE-2026-100614
Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_acti...
CVE-2026-100612
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table.
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspac...
CVE-2026-100610
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permis
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credenti...
CVE-2026-100609
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on
capgo through 12.128.2 IDOR via PUT /app icon endpoint
CVE-2026-100626
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that a
Budibase server before 3.45.0 Cross-Tenant Information Disclosure
CVE-2026-100688
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/
stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
CVE-2026-100679
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypas