@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
CVE-2026-49473
### Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar auth
#cwe-863
共收录 2248 条相关情报。
← 返回所有主题Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the ...
CVE-2026-48286
Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerabil
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control...
CVE-2026-57950
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderCon
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table...
CVE-2026-57951
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfi
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated...
CVE-2026-57953
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the ev...
CVE-2026-57953
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access co...
CVE-2026-57951
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfi
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissio...
CVE-2026-57950
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderCon
A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handle...
CVE-2026-13508
A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Sch...
CVE-2026-13484
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unkn
RustDesk gates incoming control messages on per-capability flags rather than on the session's...
CVE-2026-58056
RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type
RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags....
CVE-2026-58056
CVE-2026-58056 是 RustDesk 远程桌面软件中的一个授权绕过漏洞。RustDesk 在控制传入消息时，基于按权限的标志位而非会话的授权连接类型进行门控，且文件传输会话在结束后未清除这些标志位。因此，仅拥有有效文件传输授权
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
CVE-2026-54244
### Impact The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
CVE-2026-53521
## Summary `PATCH /server/{id}` accepts and persists nonexistent `ddns_profiles` IDs for a member-owned server. If anot
Authelia has an Edge Case Access Control Rule Mismatch
CVE-2026-48794
### Impact **CVSSv4 Baseline Score:** Low 2.4 **CVSSv4 Weighted Score:** Low 1.3 The full CVSSv4 Vector for this vuln
Blnk has an API key authorization bypass in owner and scope enforcement
Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions out
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/f...
CVE-2026-53577
Kestra 是一个开源的事件驱动编排平台。在版本 1.0.45 和 1.3.21 之前，previewFileFromExecution 端点（GET /api/v1/{tenant}/executions/{executionId}/f
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
CVE-2026-49288
### Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch di...
CVE-2026-55189
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP fronten
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. ...
CVE-2026-55188
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an a