francoisjacquet RosarioSIS Referrals.php DBUpdate authorization
CVE-2026-19784
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Disciplin
#cwe-639
共收录 1909 条相关情报。
← 返回所有主题streama contains an insecure direct object reference vulnerability in ViewingStatusController...
CVE-2026-73039
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/ap...
CVE-2026-73841
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchore
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/...
CVE-2026-73657
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4,
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status reco...
CVE-2026-73039
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
CVE-2026-73841
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchore
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation...
CVE-2026-72680
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied inpu
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized...
CVE-2026-72666
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against El
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to...
CVE-2026-72657
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls Creat...
CVE-2026-73656
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not di...
CVE-2026-72680
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied inpu
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requ...
CVE-2026-72666
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against El
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authoriz...
CVE-2026-72657
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A...
CVE-2026-72650
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Fu
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CA...
CVE-2026-72629
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Acc
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
CVE-2026-73656
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/Pl...
CVE-2026-73644
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-se
Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources ...
CVE-2026-72741
Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticat
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
CVE-2026-58445
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Gitea LFS Deploy-Key Privilege Escalation
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation