projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization
CVE-2026-86274
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the funct
#cwe-862
共收录 4122 条相关情报。
← 返回所有主题Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name...
CVE-2026-86194
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing an
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login...
CVE-2026-86194
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing an
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in...
CVE-2026-15550
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task...
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized...
CVE-2025-9049
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a mi
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and...
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 -...
CVE-2026-12843
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint,...
CVE-2026-86118
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user...
CVE-2026-86114
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to creat
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API...
CVE-2026-86116
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability check...
CVE-2026-15550
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and inclu
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authoriz...
CVE-2026-12843
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permi...
CVE-2025-9049
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a mi
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. At...
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbit...
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus
Pixelfed through 0.12.9 Unauthorized Story Access via API
CVE-2026-86178
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowin
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
CVE-2026-86177
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subus
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can...
CVE-2026-86118
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authentic
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary ...
CVE-2026-86116
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any a