Lucene search
+L

168873 matches found

EUVD
EUVD
added 2026/09/05 12:09 p.m.8 views

EUVD-2026-71995

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative...

8.7CVSS5.8AI score0.00215EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/05 12:09 p.m.23 views

CVE-2026-86190

WWBN AVideo is affected by a broken access control vulnerability in its videoViewsInfo endpoints. When a hash parameter is supplied, the endpoint returns complete user records—including password hashes , recovery tokens , and live session identifiers —to unauthenticated callers. Attackers can lev...

9.3CVSS5.8AI score0.00269EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/05 12:09 p.m.36 views

CVE-2026-86190 WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

9.3CVSS0.00269EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/05 12:09 p.m.5 views

CVE-2026-86190 WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

9.3CVSS5.8AI score
SaveExploits0References4
EUVD
EUVD
added 2026/09/05 12:09 p.m.8 views

EUVD-2026-72011

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

9.3CVSS5.8AI score0.00269EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/05 11:16 a.m.7 views

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

5.3CVSS0.00199EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/05 11:01 a.m.6 views

EUVD-2026-71977

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

5.4CVSS5.3AI score0.00184EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/05 11:01 a.m.5 views

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

5.3CVSS6AI score
SaveExploits0References6
NVD
NVD
added 2026/09/05 10:16 a.m.6 views

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

7.1CVSS0.00241EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/05 10:16 a.m.7 views

CVE-2026-86112

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

5.4CVSS0.00177EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/05 10:16 a.m.7 views

CVE-2026-86111

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

7.1CVSS0.0025EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/05 9:59 a.m.7 views

EUVD-2026-71952

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...

5.3CVSS5.3AI score0.00214EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/05 9:59 a.m.22 views

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on the glossary management API endpoints. Any authenticated user can send POST, PUT, or DELETE requests to create, modify, or delete glossary entries, allowing tampering with instance-wide business glossary data withou...

7.1CVSS5.2AI score0.00241EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/05 9:59 a.m.6 views

EUVD-2026-71948

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

7.1CVSS5.2AI score0.00241EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/05 9:59 a.m.34 views

CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

7.1CVSS0.00241EPSS
SaveExploits0References6
OSV
OSV
added 2026/09/05 9:59 a.m.10 views

CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

7.1CVSS5.8AI score
SaveExploits0References8
EUVD
EUVD
added 2026/09/05 9:59 a.m.8 views

EUVD-2026-71944

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

5.4CVSS5.3AI score0.00177EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/05 9:59 a.m.6 views

EUVD-2026-71943

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

7.1CVSS5.3AI score0.0025EPSS
SaveExploits0References5
NVD
NVD
added 2026/09/05 7:17 a.m.8 views

CVE-2026-84927

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...

2.7CVSS0.00168EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/05 7:17 a.m.7 views

CVE-2026-84901

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

4.9CVSS0.00193EPSS
SaveExploits0References1
Rows per page
Query Builder