CVE-2026-101104

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

EUVD-2026-91751

MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation...

CVE-2026-96613

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw (CWE-862) that allows authenticated users to access the complete device shadow of any device by specifying its device ID . The service fails to verify a relationship between the requester and the target device, le...

EUVD-2026-91750

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network...

EUVD-2026-91748

MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the caller's access rights against each...

EUVD-2026-91746

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering...

CVE-2025-29927

CVE-2025-29927 Next.js Middleware Bypass Scanner CVE-2025-29927 CVE-2025-29927 is a specialized security tool for detecting the Next.js middleware bypass vulnerability CVE-2025-29927 affecting Next.js versions 11.1.4 through 15.2.2. This critical vulnerability allows attackers to bypass security...

cve-2023-34034

cve-2023-34034 Demonstration of CVE-2023-34034 authorization bypass in Spring Security. See CVE-2023-34034 Spring Security Authorization Bypass on Don't Panic!...

CVE-2026-8337

CVE-2026-8337 CVE-2026-8337 is an Insecure Direct Object Reference IDOR vulnerability in Concrete CMS that affects the Survey feature. Unlike CVE-2026-8347 which involved Express associations, this vulnerability allows an unauthenticated attacker to participate in a restricted/private survey unde...

cve-2020-1764-poc

CVE-2020-1764 PoC Auth bypass PoC for Kiali 0.4.0 to 1.15.0 using login auth strategy Security Bulletin check version: curl 'http:///api check auth strategy: curl 'http:///api/auth/info' go run ./poc.go curl 'http:///api/status' -H "Authorization: Bearer $JWT"...

secdim-assurance-drift-challenge

SecDim 挑战构建器复现 — 保障级别漂移 针对一个受 CVE-2026-88861 启发的拟议安全挑战的可运行复现，发布于 2026 年 9 月 10 日。 安全概念 该应用正确地验证了签名会话，并正确地检查了 admin 角色，但它将两个独立的安全属性混为一谈：身份/角色 与 认证保障级别 。一个仅使用密码的 aal1 会话可以调用一个特权凭据创建路径，而该路径本应要求升级 MFA（aal2）。由此产生的应用范围管理员密钥是持久的，并且在原始会话注销后仍然可用。 这模拟了发生在 授权边界 上的真实 MFA 绕过失败，而不是签名损坏或令牌伪造。 可运行复现 go test -v...

CVE-2026-39717

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.9.1...

CVE-2026-32585

Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Airano MCP Bridge: from n/a through 2.11.0...

CVE-2026-39439

Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7...

CVE-2026-39444

Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3...

CVE-2025-29927

CVE-2025-29927 CVE-2025-29927: Next.js Middleware Bypass Vulnerability This repository demonstrates the CVE-2025-29927 vulnerability in Next.js where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Affected Versions Next.js 15.x 15.2.3...

CVE-2026-39717

The ThimPress LearnPress WordPress plugin (versions up to and including 4.4.9.1 ) is susceptible to a Missing Authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , which can lead to unauthorized access to restricted functions...

EUVD-2026-91665

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.9.1...

CVE-2026-39444 WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3...

CVE-2026-39444

The PublishPress Series WordPress plugin (versions 3.1.3 and below ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels , specifically identified as an Insecure Direct O...