exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql
CVE-2026-77454
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter
#cwe-863
共收录 2104 条相关情报。
← 返回所有主题Same-named aggregates with differing filters are conflated in AshSql
CVE-2026-81316
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over
Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
CVE-2026-81318
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multitenant application t
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in...
CVE-2026-82463
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate...
CVE-2026-82463
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the
pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check
CVE-2026-82463
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an...
CVE-2026-77786
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds th
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check...
CVE-2026-77704
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the req
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings b...
CVE-2026-77786
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds th
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointmen...
CVE-2026-77704
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the req
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the...
CVE-2026-80203
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
CVE-2026-55873
### Summary SeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables management API. Authorization
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through share...
CVE-2026-82272
Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset e
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-62904
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to b...
CVE-2026-55485
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0,
Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go allows an authentic...
CVE-2026-54766
Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operati
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, ext...
CVE-2026-56854
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the P
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that bas...
CVE-2026-18918
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supp
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-pr...
CVE-2026-61783
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
CVE-2026-61783
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I