Trigger.dev: V1 coordinator default-secret unauth Socket.IO
## TL;DR The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coo
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
### Summary The run replay `action` function at `apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts` has no
UTMStack before 11.2.16 contains a missing authorization vulnerability in...
CVE-2026-82041
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(),
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST...
CVE-2026-104991
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (sing
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP desti...
CVE-2026-82041
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(),
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allow...
CVE-2026-104991
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (sing
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows...
CVE-2026-96613
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to a
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specify...
CVE-2026-96613
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to a
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., vi...
CVE-2026-104914
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system...
CVE-2026-104912
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attri
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved rela...
CVE-2026-104910
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of even
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. ...
CVE-2026-101104
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to m
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: fro...
CVE-2026-39717
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access C
Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: fr...
CVE-2026-39439
Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access
Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aira...
CVE-2026-32585
Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configur
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configur...
CVE-2026-85209
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Manag
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers ...
CVE-2026-104472
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unaut
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public...
CVE-2026-104467
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenti
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-AC...
CVE-2026-104438
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/expor...
CVE-2026-104410
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protec