In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of...
CVE-2026-86490
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app imp
#cwe-863
共收录 2104 条相关情报。
← 返回所有主题In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only...
CVE-2026-86487
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canva
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
CVE-2026-86498
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
CVE-2026-86493
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteb
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
CVE-2026-86490
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app imp
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
CVE-2026-86487
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canva
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value...
CVE-2026-76560
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP clien
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wild...
CVE-2026-84173
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates mul
CVE-2026-84173
CVE-2026-84173
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates mul
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigae...
CVE-2026-86274
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the funct
projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization
CVE-2026-86274
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the funct
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user...
CVE-2026-86193
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing no
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Att...
CVE-2026-86193
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing no
SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password
CVE-2026-72792
**CVE:** This vulnerability corresponds to [CVE-2026-72792](https://nvd.nist.gov/vuln/detail/CVE-2026-72792). ### Summa
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload ...
CVE-2026-53769
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's di
SurrealDB: Writes in a PERMISSIONS clause bypass table permissions
CVE-2026-63733
A `PERMISSIONS ... WHERE` clause is evaluated with permission enforcement disabled, so it can't recurse into its own che
IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization.
CVE-2026-16941
IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper au
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, cau...
CVE-2026-19283
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authentic
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read...
CVE-2026-85697
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document vi
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated us...
CVE-2026-85622
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the esta