330 matches found
CVE-2026-92467
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint. The root cause is the omission of a current-password verification check in the user service layer (SysUserServiceImpl), allowing any authenticated user to supply ...
EUVD-2026-80705
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...
CVE-2026-92467 microservices-platform through 6.0.0 Unverified Password Change via /users/password
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...
CVE-2026-92466 microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...
CVE-2026-92466
CVE-2026-92466 affects zlt2000 microservices-platform through version 6.0.0 . The root cause is the configuration flag zlt.security.auth.urlPermission.enable defaulting to false , which disables all URL-level permission checks after a user has authenticated. As a result, any authenticated user wi...
CVE-2026-92467 microservices-platform through 6.0.0 Unverified Password Change via /users/password
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...
CVE-2026-92469: Authorization Bypass Through User-Controlled Key
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...
CVE-2026-92468: Authorization Bypass Through User-Controlled Key
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...
CVE-2026-92466: Missing Authorization
zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including use...
CVE-2026-92467: Unverified Password Change
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...
CVE-2026-16792
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...
EUVD-2026-52885
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...
Oracle GoldenGate 19.x < 19.32.0.0.260721 (July 2026 CPU)
The 19.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...
Oracle GoldenGate 21.x < 21.23.0.0.0 (July 2026 CPU)
The 21.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...
Oracle GoldenGate 23.x < 23.26.3.0.0 (July 2026 CPU)
The 23.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...
EUVD-2026-46800
Vulnerability in Oracle GoldenGate component: Oracle GoldenGate Microservices. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate...
CVE-2026-60398
Vulnerability in Oracle GoldenGate component: Oracle GoldenGate Microservices. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate...
CVE-2026-60398: Missing Authentication for Critical Function
Vulnerability in Oracle GoldenGate component: Oracle GoldenGate Microservices. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate...
PT-2026-62480
Vulnerability in Oracle GoldenGate component: Oracle GoldenGate Microservices. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate...
CVE-2026-58399 @acastellon/auth has an authentication bypass via spoofable headers in validateToken()
@acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in validateToken through spoofable auth-user and Host request headers. The validateToken middleware contains a service-to-service bypass for...