220 matches found
CVE-2026-38530: Authorization Bypass Through User-Controlled Key
A Broken Object-Level Authorization BOLA in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request...
CVE-2026-38532: Authorization Bypass Through User-Controlled Key
A Broken Object-Level Authorization BOLA in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request...
CVE-2026-38529: Improper Privilege Management
A Broken Object-Level Authorization BOLA in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request...
CVE-2026-38532
A Broken Object-Level Authorization BOLA in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request...
CVE-2026-40252: Improper Access Control
FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability IDOR/BOLA allows any authenticated team to access and execute applications belonging to other teams by supplying a foreign appId. While the API correctly validates the team token, it does not verify...
PT-2026-24619
Summary The /studiocms api/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target...
CVE-2026-24134 StudioCMS has an Authorization Bypass Through User-Controlled Key
StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization BOLA vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by...
CVE-2025-63783: Improper Input Validation
A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...
EUVD-2023-41874
Malicious code in bioql PyPI...
EUVD-2023-43962
Malicious code in bioql PyPI...
EUVD-2023-41877
Malicious code in bioql PyPI...
EUVD-2023-43961
Malicious code in bioql PyPI...
EUVD-2023-41876
Malicious code in bioql PyPI...
EUVD-2023-43964
Malicious code in bioql PyPI...
EUVD-2023-43963
Malicious code in bioql PyPI...
EUVD-2025-0088
Malicious code in bioql PyPI...
EUVD-2023-43965
Malicious code in bioql PyPI...
EUVD-2023-41878
Malicious code in bioql PyPI...