Lucene search
+L

14907 matches found

Cvelist
Cvelist
added 2026/08/25 6:23 p.m.3 views

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

8.8CVSS
SaveExploits0References4
CVE
CVE
added 2026/08/25 6:23 p.m.6 views

CVE-2026-80049

Airbyte Platform through 2.0.0 suffers a cross-workspace authorization bypass. The root cause is that AuthorizationServerHandler extracts a caller-supplied workspaceId from the raw JSON request body and sets it in the X-Airbyte-Workspace-Id header, which AuthenticationHeaderResolver.resolveWorksp...

8.8CVSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/25 6:11 p.m.18 views

EUVD-2026-37013

gRPC Erlang package's path bindings are overridable by query string and request body...

7.6CVSS5.3AI score0.00273EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/08/25 5:09 p.m.1 views

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC This is a Capture The Flag CTF styled Proof of Concept for the Next.js Middleware Authorization Bypass vulnerability CVE-2025-29927. The goal is to bypass the auth middleware and retrieve the flag from the /protected route. Vulnerabilit...

9.1CVSS5.5AI score0.99203EPSS
SaveExploits58
EUVD
EUVD
added 2026/08/25 4:13 p.m.16 views

EUVD-2026-39800

Echo: Encoded slash %2F bypasses route-level protection and exposes static files...

7.5CVSS5.8AI score0.00431EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/25 3:17 p.m.3 views

EUVD-2026-65543

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

3.5CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/25 3:16 p.m.3 views

CVE-2026-55530

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

6.1CVSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/25 2:45 p.m.7 views

CVE-2026-55530 PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

6.1CVSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/25 2:45 p.m.3 views

EUVD-2026-65501

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

6.1CVSS5.3AI score
SaveExploits0References3
NVD
NVD
added 2026/08/25 1:19 p.m.6 views

CVE-2026-78581

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

4.2CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/25 1:08 p.m.4 views

EUVD-2026-65489

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

4.2CVSS5.2AI score
SaveExploits0References1
CVE
CVE
added 2026/08/25 1:08 p.m.11 views

CVE-2026-78581

CVE-2026-78581 is an authorization bypass (CWE-639) in Kibana affecting the AI Assistant feature. An authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-g...

4.2CVSS5.3AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/25 1:08 p.m.8 views

CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

4.2CVSS
SaveExploits0References1
NVD
NVD
added 2026/08/25 12:16 p.m.6 views

CVE-2026-79672

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

7CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/25 12:16 p.m.7 views

CVE-2026-79665

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

8.8CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/25 12:16 p.m.5 views

CVE-2026-79667

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

7.6CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/25 12:16 p.m.5 views

CVE-2026-75908

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

4.3CVSS
SaveExploits0References6
NVD
NVD
added 2026/08/25 12:16 p.m.6 views

CVE-2026-17587

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

5.3CVSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/25 11:33 a.m.8 views

EUVD-2026-65442

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

7CVSS5.3AI score
SaveExploits0References2
CVE
CVE
added 2026/08/25 11:33 a.m.11 views

CVE-2026-79672

Ech0 before version 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints. Attackers holding a limited-scope access token can bypass intended restrictions to perform full comment moderation operations, including listing, approving, rejecting, and deleting comments...

7CVSS5.4AI score
SaveExploits0References2
Rows per page
Query Builder