24037 matches found
CVE-2025-65669
CVE-2025-65669 An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India...
CVE-2025-34171
CVE-2025-34171: Unauthenticated File and Debug Data Exposure in CasaOS Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34171 Affects| CasaOS ≤ 0.4.15 Fixed in| No Patch Available Severity| Medium CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-862:...
EUVD-2026-71773
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents...
EUVD-2026-71777
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-52766
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...
PT-2026-86325
🚨 CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, includin...
AZL-99690 CVE-2026-86090 affecting package ntopng 5.2.1-6
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-82684
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents...
CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
CVE-2026-86091
ntopng before 6.7.260717 fails to enforce administrator privileges in the host-pools bulk-delete REST endpoint (handled in pools_rest_utils.lua). An authenticated non-administrative user can issue POST requests to delete all host pools and their member bindings irreversibly, removing traffic poli...
CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
CVE-2026-86090
ntopng before 6.7.260717 fails to perform authorization checks in the REST v2 delete handlers for notification endpoints and recipients (in endpoints.lua and recipients.lua). An authenticated non-administrator user can issue POST requests to irreversibly delete all configured notification endpoin...
CVE-2026-53769
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...
CVE-2026-82684 Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents...
CVE-2026-82684
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior contain a Missing Authorization flaw that could allow an attacker to extract system credentials, configurations, or flash contents. The device is deployed in critical manufacturing and energy sectors . This CVE is part of a group of three ...
CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...
CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...
CVE-2026-53602 nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...
WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability
Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by d.v4ns3c in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.7.1...