A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a...
CVE-2026-54360
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the
#cwe-639
共收录 1946 条相关情报。
← 返回所有主题A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then...
CVE-2026-42947
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently
File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
CVE-2026-54097
### Summary A low-privileged authenticated user of filebrowser (with `create` + `delete` permissions in their own isolat
MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attributes. Several controller actions acc...
CVE-2026-54361
MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegatio
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not remove a user-supplied id field befor...
CVE-2026-54360
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the
An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site administrator accounts wi...
CVE-2026-54357
An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $r...
CVE-2026-53726
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the a...
CVE-2026-42947
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in an...
CVE-2026-8828
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization contr...
CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorizatio
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in...
CVE-2026-45830
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated us
Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configura...
CVE-2026-44207
Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows a
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of a...
CVE-2026-47238
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can e
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
CVE-2026-48067
The `recordSelectOptionsQuery()` method may be used to scope the options available in the `Select` field for `AttachActi
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global d...
CVE-2026-47189
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the A
IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify...
CVE-2026-7787
IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypass
IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.
CVE-2026-7787
IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypass
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging...
CVE-2026-8406
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticate
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request se...
CVE-2026-8406
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticate
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could ...
CVE-2026-6976
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, an