CVE-2026-112000

Vanus versions 0.8.0 through 0.9.0 are affected by a missing authorization vulnerability in the gateway. This flaw allows any authenticated user to invoke Subscribe , Ack , and unregistered methods without proper permission checks. An attacker can exploit this by providing another tenant's subscr...

CVE-2026-112000 Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and...

CVE-2018-18449

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339...