181573 matches found
CVE-2026-108654: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...
CVE-2026-108650: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...
iOS26.6-CVE-2026-65343
CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...
cve-2020-10977
CVE-2020-10977 GitLab 12.9.0 Lectura Arbitraria de Archivos Objetivo : 12.9.0 e inferiores Probado : GitLab 12.8.1 En una reciente evaluación encontré una instancia de GitLab en el objetivo, encontré un PoC en Exploit-DB pero usa LDAP para autenticación y en este caso estaba deshabilitado, así qu...
CVE-2026-108258
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
GHSA-X34J-47HF-4XG7 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...
GHSA-3HC7-R24J-RPWC Vikunja: Cross-project task disclosure through subtask expansion
Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...
Contao: Improper access control in the table access voter
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container DCA backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This include...
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
Summary API token permission checks only match the HTTP method and route path. The expand query parameter on task read endpoints embeds data from other permission groups task comments, reactions, time entry counts without checking whether the token holds those scopes. A token scoped only to tasks...
CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...
GHSA-R6W9-259G-GWRV Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over...
CVE-2026-107851 Contao: Improper access control in the table access voter
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...
WordPress Divi Plus plugin <= 2.4.0 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by ShinThink in WordPress Plugin Divi Plus versions = 2.4.0...
CVE-2026-75351
A flaw was found in OpENer. An out-of-bounds read vulnerability in the server-side EtherNet/IP ForwardOpen connection-path parser allows a remote attacker to trigger an application crash. By sending a specially crafted connection request, an attacker can exploit this flaw to cause a Denial of...
Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni
Summary IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-87795 DESCRIPTION: zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress...
CVE-2026-75351
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service...
CVE-2026-75353
OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service...
CVE-2026-107817
A flaw was found in the mysqljson plugin in MariaDB. The plugin incorrectly assumes that imported MySQL tables contain valid binary JavaScript Object Notation JSON data. An attacker can exploit this issue by supplying a specially crafted MySQL table containing invalid JSON data, triggering an...