Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
CVE-2026-44504
## Impact Aegra deployments running 0.9.0 through 0.9.6 with multiple authenticated users on a shared instance are vuln
#cwe-639
共收录 1947 条相关情报。
← 返回所有主题ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data
CVE-2026-44423
## Summary `GET /api/sessions/:uid` returns the full session object for any authenticated caller, without scoping by the
ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace
CVE-2026-44424
## Summary `GET /api/devices/:uid` returns the full device object whenever the caller is authenticated, without verifyin
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor...
CVE-2026-7573
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 a
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve th...
CVE-2026-7573
CVE-2026-7573 是一个影响 Velociraptor（Velocidex 开发的数字取证与事件响应工具）的授权绕过漏洞。该漏洞存在于 GetUserRoles gRPC API 端点中，属于 CWE-639（授权绕过）。在版本
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
CVE-2026-43883
## Summary `plugin/PayPalYPT/agreementCancel.json.php` cancels a PayPal billing agreement using an attacker-supplied `a
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows...
CVE-2026-41950
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the fu
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
CVE-2026-42609
### Summary A business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation
Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the s...
CVE-2026-41950
Dify 1.14.0 之前版本存在授权绕过漏洞，漏洞位于聊天消息端点。认证用户可通过在请求的 files 数组中提供任意文件 UUID，读取同一租户内其他用户上传的文件完整内容。漏洞根源在于这些端点缺乏对所有权的验证，仅依赖文件 UUID
The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level author...
CVE-2026-3454
The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inc
The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a u...
CVE-2026-2729
The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0.
A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php of the component Te...
CVE-2026-7782
A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the fil
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with a valid API key scoped to variable:list could read...
CVE-2026-42227
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated use
Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerability in the QR code scanning endpoint that allows unauthent...
CVE-2026-41471
Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerabili
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to im...
CVE-2026-29200
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2
A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of the component Pub...
CVE-2026-7702
A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the
A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/d...
CVE-2026-7681
A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible...
CVE-2026-2554
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ve...
CVE-2026-2554
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is
School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing...
CVE-2026-7491
School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote att