120990 matches found
CVE-2026-2651
A vulnerability in MLflow versions =3.10.1.dev0 allows unauthorized access to multipart upload MPU endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/ endpoints, enabling attackers to overwrite...
CVE-2026-9409
A flaw has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This affects an unknown part of the file /user of the component User Management Handler. This manipulation of the argument role causes improper authorization. It is possible to initiate the attack...
WordPress plugin GamiPress 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
The vulnerability of the BuildKit container-building software lies in the improper restriction of the path name to the restricted-access directory, which allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the BuildKit container-building software is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the aiohttp HTTP client, related to the lack of protection for service data, allows attackers to gain unauthorized access to protected information.
The vulnerability of the aiohttp HTTP client is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the Active Storage library for connecting cloud and local files to Rails applications involves an incorrect path name limitation for the restricted access directory, allowing attackers to gain unauthorized access to protected information.
The vulnerability of the Active Storage library for connecting cloud and local files to Rails applications is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected...
The vulnerability of the Golang programming language, related to deficiencies in authentication mechanisms, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Go programming language is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
WordPress plugin SePay Gateway 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
The vulnerability in the Open WebUI web interface, related to the mechanism for restricting access to API keys, allows attackers to bypass existing security measures and gain unauthorized access to protected information.
The vulnerability in the Open WebUI web interface is related to the mechanism for restricting access to API keys. Exploiting this vulnerability allows a malicious actor to bypass existing security measures and gain unauthorized access to protected information...
The vulnerability of the node-tar library in the Node.js software platform arises from incorrect path name restrictions for restricted-access directories. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the node-tar library in the Node.js software platform is related to an incorrect limitation on the path name for the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
The vulnerability of the node-tar library on the Node.js software platform allows attackers to gain unauthorized access to protected information.
The vulnerability of the node-tar library in the Node.js software platform is related to an incorrect limitation on the path name for the restricted-access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the package manager for Kubernetes Helm, related to an incorrect path name limitation for the restricted access directory, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the package manager for Kubernetes Helm is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to protected information...
PT-2026-43026
This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory. An attacker with physical access could exploit this vulnerability by accessing the UART interface and performing memory extraction to obtain sensitive information, including...
PT-2026-43149
Name of the Vulnerable Software and Affected Versions Smart Coupons for WooCommerce versions prior to 2.3.0 Description A missing authorization issue in WebToffee Smart Coupons for WooCommerce allows for the exploitation of incorrectly configured access control security levels. This is a broken...
MAL-2026-4669 Malicious code in shiroai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cde2f64fd59e62071433f92eab83a4817f0b306ff1735aa8c31ae31dcaf9830 shiroai is advertised as a CLI where the installer authenticates with their own API key via shiroai login . In practice, cli.js ignores any...
Malicious code in @jonusnattapong/claudecode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a08b3e13079279fb9dce40859dd868b0953bec139996eb7ac915a7dc415b29c Package is a third-party reconstruction of Anthropic's Claude Code CLI that misrepresents itself as the official product. package.json describes itse...
Besen BS20 EV Charging Station 安全漏洞
The Besen BS20 EV Charging Station is an AC electric vehicle wall-mounted charging station developed by the Chinese company Besen. The Besen BS20 EV Charging Station, including versions dated before April 2026, has a security vulnerability. This vulnerability stems from improper operation of...
ROS-20260524-73-0006
A vulnerability in the JGSS component of the Oracle Java SE software platform, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is associated with a breach of the data protection mechanism. Exploitation of the vulnerability could allow a remote attacker to gain...
JPress 授权问题漏洞
JPress is a blog platform developed using the Java language by the JPress team. Versions of JPress 1.0.3 and earlier contained an authorization vulnerability. This vulnerability stemmed from improper handling of the parameter id/userId in the UCenter Article Submission Endpoint component, which...