TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath
CVE-2026-48763
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/t
#cwe-862
共收录 4167 条相关情报。
← 返回所有主题OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests ...
CVE-2026-69115
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-o
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing t...
CVE-2026-18709
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be...
CVE-2026-18704
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perfor
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without p...
CVE-2026-69113
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authentica
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
CVE-2026-70340
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.
CVE-2026-65806
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
CVE-2026-62915
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a net
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.
CVE-2026-61936
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature lo
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-59113
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
CVE-2026-40375
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's ...
CVE-2026-56720
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId...
CVE-2026-48495
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JS
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any...
CVE-2026-42142
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getShee
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read th...
CVE-2026-19539
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5
Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the t...
CVE-2026-73155
Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments...
CVE-2026-73140
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report ex
SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authentica...
CVE-2026-66772
SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on cer
SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated atta...
CVE-2026-58244
SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain applicati
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database o...
CVE-2026-58243
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attack