Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor nev...

CVE-2026-113611

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep rec

历史摘要 · 未重新核验 · NVD

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_co...

CVE-2026-113607

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authentica

历史摘要 · 未重新核验 · NVD

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacemen...

CVE-2026-112956

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate

历史摘要 · 未重新核验 · NVD

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predicta...

CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hij

历史摘要 · 未重新核验 · NVD

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/sys...

CVE-2026-113354

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permis

历史摘要 · 未重新核验 · NVD

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0...

CVE-2026-12489

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.4

历史摘要 · 未重新核验 · GitHub Advisory

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to esca...

CVE-2026-12489

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.4

历史摘要 · 未重新核验 · NVD

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.

CVE-2026-86977

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An

来源摘录 · NVD

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSit...

CVE-2026-112776

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens

历史摘要 · 未重新核验 · NVD

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An auth...

CVE-2026-112769

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissi

历史摘要 · 未重新核验 · NVD

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

## Summary The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT `sub` claim) specifi

历史摘要 · 未重新核验 · GitHub Advisory

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner...

CVE-2026-111929

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gR

历史摘要 · 未重新核验 · GitHub Advisory

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow...

CVE-2026-111928

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/po

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in...

CVE-2026-111918

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that al

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project...

CVE-2026-111921

Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write per

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization...

CVE-2026-111900

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.p

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows...

CVE-2026-111888

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking

历史摘要 · 未重新核验 · GitHub Advisory

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-cl...

CVE-2026-111044

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted

来源摘录 · NVD

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

CVE-2026-96628

## Summary Arcane v2.10.2 contains an authorization inconsistency in `AuthMiddleware.managerAuth`. When a request supp

历史摘要 · 未重新核验 · GitHub Advisory

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Spa...

CVE-2026-61726

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, St

来源摘录 · NVD