17368 matches found
EUVD-2026-95885
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...
CVE-2026-108112
The ruoyi-ai software, versions 3.0.0 through 3.1.0 , is vulnerable to a missing authorization flaw (CWE-862). Authenticated users can delete workflows belonging to other users via the POST /workflow/del/{uuid} endpoint. The root cause is that the softDelete() function fails to invoke the Privile...
CVE-2026-87846
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...
CVE-2026-87846 Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...
EUVD-2026-95707
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...
EUVD-2026-95578
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...
CVE-2026-107935
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...
CVE-2023-37598
CVE-2023-37598 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF Overview CVE ID: CVE-2023-37598 Vulnerability Type: Cross-Site Request Forgery CSRF Affected Product: issabel-pbx v4.0.0-6 Severity: Medium Discovered by: Sahil Ojha Disclosure Date: 10/07/2023 Vendor Homepage:...
CVE-2026-107886
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, addclass frees pclass-printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer;...
EUVD-2026-95336
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory...
EUVD-2026-95350
Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's...
PT-2026-108872
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...
PT-2026-108766
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the tcf idr delete index function fails to properly validate lookup results. When tcf action delete drops a reference, an unlocked...
PT-2026-108720
Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions prior to 2.4.20 Description A double-free issue exists in printer-class management. When the 'CUPS-Add-Modify-Class' operation replaces an existing class member list, the add class function frees pclass-printers...
CVE-2026-82900
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory...
CVE-2026-107831
Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...
CVE-2026-107793
Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's...
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...