GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval
CVE-2026-84205
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against
#cwe-639
共收录 1909 条相关情报。
← 返回所有主题This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this ...
CVE-2026-84148
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoin
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Updat...
CVE-2026-83743
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /ve
invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization
CVE-2026-83743
A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /ve
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check fro...
CVE-2026-82395
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8,
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows...
CVE-2026-72001
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access a
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet...
CVE-2026-80197
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard rou...
CVE-2026-81892
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin s
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageR...
CVE-2026-75460
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /ap
The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface a...
CVE-2026-75458
The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a ver
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement...
CVE-2026-50198
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled...
CVE-2026-72001
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access a
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/pr...
CVE-2026-53552
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile,
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
CVE-2026-53552
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile,
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session...
CVE-2026-82816
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version...
CVE-2026-79750
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
CVE-2026-79750
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was aut...
CVE-2026-78075
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing a...
CVE-2026-82874
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organiza
ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose TooljetDB ...
CVE-2026-82873
ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpo