265734 matches found
axios: Axios: HTTP header injection via inherited prototype properties
A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...
CVE-2026-104403
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
EUVD-2026-91380
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
CVE-2026-104403 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
CVE-2026-104403
The ThimPress LearnPress WordPress plugin (versions up to and including 4.4.9 ) is susceptible to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw arises from incorrectly configured access control security levels , which can lead to Insecure Direct Object References (I...
CVE-2026-104403 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Amelia versions = 2.4.10...
WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ProfilePress versions = 4.17.3...
WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ProfilePress versions = 4.17.3...
WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Forminator versions = 1.57.2...
CVE-2026-21140
Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...
CVE-2026-21140
Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...
CVE-2026-21140
A vulnerability exists in ManagedProvisioning prior to SMR Sep-2026 Release 1 due to improper access control . This flaw allows local attackers to install arbitrary applications on the affected system. Specific exploit details are not provided in the documents.
CVE-2026-21140
Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...
EUVD-2026-91157
Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...
SUSE CVE-2022-29224
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can "hold" prevent removal upstrea...
EUVD-2026-91115
Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...
EUVD-2026-91116
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...