9 matches found
CVE-2026-82074
CVE-2026-82074 is an incorrect authorization vulnerability in the MongoDB Server aggregation framework . An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what i...
CVE-2026-41006
Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3...
CVE-2026-34747
Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patche...
CVE-2026-28217
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the userCollection GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized data field containing HTTP requests with headers and potentially...
CVE-2026-28217
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the userCollection GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized data field containing HTTP requests with headers and potentially...
CVE-2025-58152
FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication...
CVE-2025-58152
The CVE-2025-58152 entry concerns Century Systems FutureNet MA and IP-K series devices. According to connected sources, the vulnerability involves exposing firmware version and garbage collection information on an internal web page, which can be accessed via crafted HTTP requests without authenti...
PT-2025-44581
Name of the Vulnerable Software and Affected Versions FutureNet MA and IP-K series versions affected versions not specified Description FutureNet MA and IP-K series devices from Century Systems Co., Ltd. expose firmware version and garbage collection information on an internal web page. This...