An authenticated user may view private Puppet module metadata without repository read access.
CVE-2026-66379
An authenticated user may view private Puppet module metadata without repository read access.
#cwe-862
共收录 4167 条相关情报。
← 返回所有主题An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
CVE-2026-66378
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
An unauthenticated user may access restricted repository information under specific conditions.
CVE-2026-66377
An unauthenticated user may access restricted repository information under specific conditions.
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
CVE-2026-66375
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same...
CVE-2026-47233
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `
NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCO...
CVE-2026-53996
NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unpr
Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files fr...
CVE-2026-47226
Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI i...
CVE-2026-18652
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its pub...
CVE-2026-19052
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX ac
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-si...
CVE-2026-18789
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality,
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of pos...
CVE-2026-18035
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allo
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this i...
CVE-2026-64954
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, th
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits n...
CVE-2026-73249
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{librar
calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification
CVE-2026-73249
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{librar
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in...
CVE-2026-15606
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated...
CVE-2026-69115
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-o
An issue in MongoDB Server could allow an authenticated user with direct network access to a...
CVE-2026-18709
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only...
CVE-2026-18704
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perfor
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` ...
CVE-2026-48763
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/t
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly ...
CVE-2026-15606
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i