EUVD-2026-97045

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108871

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the saveDatarule handler of the SysDepartRoleController. This vulnerability allows low-privileged authenticated users to modify department role data rules by sending crafted permissionId, roleId, and dataRuleIds...

EUVD-2026-97044

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

CVE-2026-108870

The JeecgBoot framework, versions through 3.9.5 , is vulnerable to a missing authorization flaw in the SysRoleController saveDatarule handler. A low-privileged authenticated user can exploit this by sending permissionId, roleId, and dataRuleIds via a POST request to /sys/role/datarule. This allow...

EUVD-2026-96566

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

CVE-2026-108640

The JeecgBoot framework, versions through 3.9.5 , contains a missing authorization vulnerability (CWE-862) in the SysDepartRoleController queryById handler. The root cause is the absence of necessary Shiro permission annotations , which allows low-privileged authenticated attackers to perform una...

CVE-2026-108627

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability within the loadDatarule handler of the SysRoleController component. This flaw allows any authenticated user to perform unauthorized queries via the GET /sys/role/datarule/{permissionId}/{roleId} endpoint. A l...

CVE-2026-13207

The CVE refers to FUXA prior to 1.3.2 with an authentication bypass in the REST API caused by improper normalization of dot-segments in the router. Prefixing paths with dot-segments (e.g., /api/./users, /api/./roles, /api/project/../users) can bypass authentication and expose protected data such ...

EUVD-2026-40409

FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by...

CVE-2026-13207 Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing

FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by...

UFO³ 安全漏洞

UFO³ is an open-source cross-device collaboration multi-agent task orchestration tool developed by Microsoft. Version UFO³ 3.0.1-4-ge2626659 contains security vulnerabilities. These vulnerabilities stem from the WebSocket control plane’s reliance on identity and role fields provided by clients,...

PT-2026-41869

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the Admin API allows a low-privilege administrator with the 'view-clients' role to cause cross-role personally identifiable information PII leakage. By invoking the 'evaluate-scope...

CVE-2026-42069

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-42069

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-42069 Kirby: Read access to site, user and role information is not gated by permissions

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0...

EUVD-2026-28888

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-42069

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0...

Kirby 安全漏洞

Kirby is a set of open-source content management systems based on files. Versions of Kirby prior to 4.9.0 and 5.4.0 have security vulnerabilities, which stem from the lack of permission control over access to site, user, and role information...

Kirby CMS's read access to site, user and role information is not gated by permissions

TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. This vulnerability is of high severity for affected sites. Sites using Kirby are not affected if they intend all users of the site to be able to list and access the site...

CVE-2025-61197

Several Orban broadcast audio processor products, including Optimod 5950 , Optimod 5950HD , Optimod 5750 , Optimod 5750HD , and Optimod Trio , are vulnerable when running Optimod version 1.0.0.33 through System version 2.5.26 . The root cause is that the application stores user privilege and role...