geex-arts django-jet Dashboard views.py authorization
CVE-2026-16214
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/das
#cwe-639
共收录 1926 条相关情报。
← 返回所有主题IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the...
CVE-2026-13445
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read an
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and...
CVE-2026-55518
Avo 是一个用于 Ruby on Rails 应用创建管理后台的框架。在版本 3.32.1 和 4.0.0.beta.51 之前，Avo 的关联附加工作流在 UI 和 GET /resources/:resource/:id/:relat
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying abso...
CVE-2026-13445
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read an
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api...
CVE-2026-63307
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{i
Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video...
CVE-2026-12693
Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessi
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering...
CVE-2026-11763
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D
TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the...
CVE-2026-63099
TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints t
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentM...
CVE-2026-48016
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
CVE-2026-48016
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSourceService.queryExi...
CVE-2026-63307
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{i
Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This ...
CVE-2026-12693
Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessi
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management S...
CVE-2026-11763
Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D
TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments b...
CVE-2026-63099
TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints t
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifie...
CVE-2026-63095
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any
Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource
CVE-2026-63307
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{i
TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints
CVE-2026-63099
TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints t
Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
CVE-2026-63095
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any
Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hash...
CVE-2026-22104
Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows
Improper access control in Hashtopolis server chunk activity component
CVE-2026-22104
Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows