The vulnerability of the Imperative Web Server component in the Oracle Helidon library of the Oracle Fusion Middleware software platform allows a perpetrator to cause a service failure.

The vulnerability of the Imperative Web Server component in the Oracle Helidon library of the Oracle Fusion Middleware software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to cause service interruptions...

The vulnerability of the Imperative Web Server component of the Oracle Helidon library in the Oracle Fusion Middleware software platform allows a perpetrator to gain access to add, delete, modify, and read data.

The vulnerability of the Imperative Web Server component of the Oracle libraries in the Oracle Fusion Middleware software suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to add, delete, modify, and read data...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

CVE-2026-69129

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-80183

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...

CVE-2026-77298

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

EUVD-2026-66807

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...

CVE-2026-69129

KubePi , a Kubernetes multi-cluster management panel by 1Panel-dev, contains an authorization flaw in versions up to and including 2.0.0 . Cluster-scoped APIs do not consistently validate per-cluster access, meaning an authenticated user granted management rights over one cluster can, under certa...

CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2024-46627

CVE-2024-46627 - Controllo di accesso errato in BECN DATAGERRY v2.2 consente agli attaccanti di eseguire comandi arbitrari tramite richieste web appositamente create. DATAGERRY v2.2 non dispone di controllo degli accessi nella REST API per i seguenti endpoint: /rest/users//settings/ GET, POST...

EUVD-2026-66759

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-62249

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

CVE-2026-55228

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-55227

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

EUVD-2026-66720

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

EUVD-2026-66717

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...