dir-3040_dos

Denegación de Servicio en dir-3040 El Dir-3060 también podría verse afectado, ya que comparten muchos componentes del mismo firmware. Probado en el último firmware 1.20b03a hotfix La página de acceso de usuario del servidor FTP está configurada por defecto para que cualquier usuario con privilegi...

CVE-2024-42327

PoC and Exploit for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being calle...

CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-79747

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, is vulnerable to SSRF prior to version 1.0.32. An authenticated non-admin user can register a server pointing at an arbitrary URL, causing the hub to issue server-side requests with no egress filtering (loopback, R...

CVE-2021-42562

CVE-2021-42562: Fehlerhafte Zugriffskontrolle in MITRE Caldera Caldera Versionen =2.8.1 trennt Benutzerrechte nicht ordnungsgemäß, sodass Nicht-Admin-Benutzer Zugriff auf das Lesen und Ändern von Konfigurationen oder anderen Komponenten haben, die nur für Admin-Benutzer zugänglich sein sollten...

EUVD-2026-65700

In Dradis Community Edition, the ProvidersController and AgentsController gate their adminrequired beforeaction on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...

CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79665 Ech0 before 4.5.1 Authorization Bypass via Session Tokens

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

Astra Linux – Vulnerability in open-vm-tools

VMware Tools 12.0.0, 11.x.y, and 10.x.y contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the guest OS can escalate privileges as a root user in the virtual machine...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-67207

CVE-2026-67207 affects Wolf CMS up to version 0.8.3.1. The vulnerability is an authorization bypass in the BackupRestoreController caused by a PHP operator precedence flaw in the permission check expression. This allows authenticated non-administrative users to access restricted backup functional...

PT-2026-66574

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0 Description Authenticated non-admin users can enumerate sequential custom option IDs to read labels belonging to admin-only user or group custom fields. This occurs because the endpoint "/api/v3/custom...

PT-2026-66601

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.2 Description An authorization bypass exists in the BackupRestoreController due to a PHP operator precedence flaw in the permission check expression. This allows authenticated users without administrative...

EUVD-2026-49576

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

EUVD-2026-42618

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission...

CVE-2026-63307

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...

CVE-2026-63307 Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...