Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session...
CVE-2026-55197
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows aut
#cwe-639
共收录 1926 条相关情报。
← 返回所有主题Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export...
CVE-2026-55198
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows a
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
CVE-2026-55518
## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resource
Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
CVE-2026-54324
### Summary A cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user
Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
CVE-2026-54015
## Summary Open WebUI's prompt version-history endpoints authorize the `prompt_id` in the URL but then act on caller-su
OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers...
CVE-2026-53863
OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidate
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
CVE-2026-54322
### Summary Daytona's organization role update and delete endpoints authorized the caller as an owner of the organizatio
OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a group ID to the p...
CVE-2026-53863
OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidate
The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shor...
CVE-2026-10780
The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smugg...
CVE-2026-48599
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to acc
Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
CVE-2026-52699
Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.
CVE-2026-48872
Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
CVE-2026-48868
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
CVE-2026-52699
Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.
CVE-2026-48872
Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
CVE-2026-48868
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.
CVE-2026-40792
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
CVE-2026-39518
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.
CVE-2025-59133
Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.
A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/cont...
CVE-2026-12204
A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/Pa