Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id...

CVE-2026-46408

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3

历史摘要 · 未重新核验 · NVD

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authent...

CVE-2026-46407

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3

历史摘要 · 未重新核验 · NVD

Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, explorations.replace, and exp...

CVE-2026-44718

Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to befor

历史摘要 · 未重新核验 · NVD

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shar...

## Summary **Type:** Authorization-bypass via user-controlled identifier. The Meet plugin's recorded-video upload endpo

历史摘要 · 未重新核验 · GitHub Advisory

Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

CVE-2026-44692

Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then re

历史摘要 · 未重新核验 · GitHub Advisory

Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with...

CVE-2026-8629

Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only acc

历史摘要 · 未重新核验 · GitHub Advisory

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the ...

CVE-2026-44678

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{

历史摘要 · 未重新核验 · NVD

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

CVE-2026-45671

### Summary Any authenticated user can permanently delete files owned by other users via `DELETE /api/v1/files/{id}` wh

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI has an Indirect Object Reference (IDOR) in user notes

CVE-2026-45666

### Summary The API /api/v1/notes/{note_id} endpoint lacks proper authorization checks, allowing authenticated users to

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

CVE-2026-45402

# Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints ## Summary Mult

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

CVE-2026-45398

# IDOR: Retrieval API Bypasses Knowledge Base Access Controls **Author:** Andrew Orr ## Summary `_validate_collectio

历史摘要 · 未重新核验 · GitHub Advisory

Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress agent tickets by s...

CVE-2026-8629

Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only acc

历史摘要 · 未重新核验 · NVD

gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any pr...

CVE-2026-44544

gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference S

历史摘要 · 未重新核验 · NVD

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stabl...

CVE-2026-42572

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a

历史摘要 · 未重新核验 · NVD

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authe...

CVE-2026-44504

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared

历史摘要 · 未重新核验 · NVD

Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Autom...

CVE-2025-15025

Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and

历史摘要 · 未重新核验 · NVD

Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi all...

CVE-2026-6008

Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Pu

历史摘要 · 未重新核验 · NVD

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ paramete...

CVE-2026-5798

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ en

历史摘要 · 未重新核验 · NVD

Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Media App allows Accessing Functionality Not Properly Constr...

CVE-2025-12008

Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Med

历史摘要 · 未重新核验 · NVD

Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking. This issue affects...

CVE-2026-2347

Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Comme

历史摘要 · 未重新核验 · NVD