Helmet Store Showroom v1.0 - SQL Injection

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access. id: CVE-2022-46071 info: name: Helmet Store Showroom v1.0 - SQL Injection author: Harsh severity: critical description: | There is SQL Injection vulnerability...

KubePi JwtSigKey - Admin Authentication Bypass

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...

DEBIAN-CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

EUVD-2026-62703

Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow update rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR...

CVE-2026-41424 Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

EUVD-2026-60599

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-72829

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope-cap bypass in UsersController's create and update methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin check that reads access.api.super...

CVE-2026-72828

Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...

CVE-2026-72833

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-72833

The Grav API plugin (getgrav/grav-plugin-api) versions 1.0.6–1.0.11 contain a privilege-escalation vulnerability. A scoped API key minted on a super-admin account bypasses the scope cap on four isSuperAdmin()-gated write endpoints (GroupsController, AccountsConfigController, PreferencesController...

PT-2026-71998

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API-key scope-cap bypass exists in the create and update methods of the UsersController. While these methods enforce scope caps for api.users.write, they rely on a...

CVE-2026-73629 Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address...

EUVD-2026-56855

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

GHSA-5QJQ-93H5-HRGP vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-70376 Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

EUVD-2026-52292

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in setenv.php where the redirectToLoginAdminIRequestHaveAccessToken function derives the current page name from PHPSELF and skips authentication when the value...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...

CVE-2026-53444

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidcserver.js, server/models/org.js, and server/models/team.js are globally callable without the admin authorization checks used by their non-OIDC counterparts. Authenticated use...