Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
CVE-2026-93529
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) ex...
CVE-2026-76648
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs n
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotification...
CVE-2026-76089
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a ...
CVE-2026-76087
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFor...
CVE-2026-76086
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings
/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) re...
CVE-2026-71460
/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authen...
CVE-2026-71459
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions()
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequat...
CVE-2026-52744
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API a
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
CVE-2026-76087
### Impact The anonymous front-end action `formie/submissions/submit` (`SubmissionsController::actionSubmit`) trusted a
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
CVE-2026-76087
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
CVE-2026-76086
### Impact The control panel action `formie/integrations/form-settings` (`IntegrationsController::actionFormSettings`)
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
CVE-2026-76086
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings
Formie: Missing authorization on sent notification resend modal exposes submission PII
CVE-2026-76089
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese
GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
CVE-2026-52744
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API a
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserv...
CVE-2026-95846
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will messa
Moquette publishes Last-Will messages without enforcing write authorization
CVE-2026-85724 · CVE-2026-95842 · CVE-2026-95843 · CVE-2026-95844 · CVE-2026-95845 · CVE-2026-95847 · CVE-2026-95848 · CVE-2026-95846
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will messa
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization.
CVE-2026-18179
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.
CVE-2026-18177
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payme
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the a...
CVE-2026-96446
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent au
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does ...
CVE-2026-87848
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its A