114643 matches found
CVE-2026-54553
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...
BIT-NEO4J-ENTERPRISE-2024-34517
The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access...
llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)
starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: GHSA-6753-GR46-6WPR...
llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)
starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: OSV:GHSA-6753-GR46-6WPR...
GHSA-6753-GR46-6WPR Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...
EUVD-2026-66559
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...
llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) +4 more potentially affected by CVE-2026-54553 via starlette-admin (>=0.9.0, <=0.14.1)
starlette-admin PYPI version =0.9.0, =2.1.0, =1.1.0, =0.0.3, =0.3.7a1, =0.1.0, =0.1.2, =0.1.10 Source cves: CVE-2026-54553 Source advisory: MEND:CVE-2026-54553...
CVE-2026-54553
Starlette-Admin , an administrative interface framework for FastAPI/Starlette applications, is affected by an unvalidated order_by parameter in its list API prior to 0.16.1 . The backend does not validate user-supplied order_by and structured where field names against the configured sortable_fiel...
CVE-2026-54553
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...
CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...
CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...
CVE-2026-54553 Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied orderby and structured where field names against the configured sortablefields and searchablefields...
CVE-2026-80203
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
CVE-2026-80203
The getgrav/grav-plugin-api plugin before 1.0.18 contains an authentication bypass in the requireNotSuperTarget() function within UsersControllers.php, affecting seven sensitive user-management endpoints. The root cause is that the scope check calls isSuperAdmin() on the acting account rather tha...
CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...
CVE-2026-19197
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...
CVE-2026-19197
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...
UBUNTU-CVE-2026-19197
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...