Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint r...

CVE-2026-55433

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · NVD

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not val...

CVE-2026-55432

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · NVD

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning...

CVE-2026-59704

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metada

历史摘要 · 未重新核验 · GitHub Advisory

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

CVE-2026-55433

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · OSV.dev

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

CVE-2026-55432

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · OSV.dev

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

CVE-2026-53487

## Summary Authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not

历史摘要 · 未重新核验 · GitHub Advisory

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticat...

CVE-2026-59704

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metada

历史摘要 · 未重新核验 · NVD

Cap - Missing Access Control in Video AI Metadata Endpoint

CVE-2026-59704

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metada

历史摘要 · 未重新核验 · OSV.dev

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs...

CVE-2026-59708

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeU

历史摘要 · 未重新核验 · GitHub Advisory

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registerin...

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite

历史摘要 · 未重新核验 · NVD

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile H...

CVE-2026-55417

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user ena

历史摘要 · 未重新核验 · NVD

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validatio...

CVE-2026-53730

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql en

历史摘要 · 未重新核验 · NVD

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-onl...

CVE-2026-50007

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared us

历史摘要 · 未重新核验 · NVD

@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

### Am I affected? Users are affected if all of these hold: - They install and register the `@better-auth/scim` plugin

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

CVE-2026-53514

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` with th

历史摘要 · 未重新核验 · GitHub Advisory

Actual: Shared users can perform owner-only file management actions

CVE-2026-50007

Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared us

历史摘要 · 未重新核验 · OSV.dev

Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite

历史摘要 · 未重新核验 · OSV.dev

DataEase: Unauthorized Access to Engine Database via previewSql Endpoint

CVE-2026-53730

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql en

历史摘要 · 未重新核验 · OSV.dev

Chevereto private profile setting leaks username on /json endpoint

CVE-2026-55417

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user ena

历史摘要 · 未重新核验 · OSV.dev

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full ...

CVE-2026-59708

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeU

历史摘要 · 未重新核验 · NVD