NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

EUVD-2026-66252

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris: register में लोकेशन सत्यापन से पहले क्रेडेंशियल वितरण CVE-2026-64640 के लिए एक स्व-निहित, एक-कमांड रीप्रोड्यूसर: Apache Polaris में Iceberg REST register एंडपॉइंट, कॉलर द्वारा दिए गए पाथ के लिए क्लाउड स्टोरेज क्रेडेंशियल जारी करते हैं और उस पाथ को कैटलॉग की...

EUVD-2026-42989

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...

CVE-2026-56100 SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestControll...

CVE-2026-56100 SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestControll...

CVE-2026-54917-SeaweedFS-Cross-Bucket-Traversal

CVE-2026-54917 — SeaweedFS S3 gateway: path traversal tra bucket Proof-of-concept e analisi tecnica per CVE-2026-54917 , un path traversal nel gateway API S3 di SeaweedFS che consente a un chiamante di accedere a oggetti in qualsiasi bucket , indipendentemente da ciò per cui le sue credenziali so...

Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Asset / scope: Yamcs 5.12.7 WebSocket topics packets, algorithm-status, mdb-changes Summary Several WebSocket subscription handlers do not perform the privilege check that their REST counterparts enforce, so a principal subscribing over WebSocket receives data the REST API would have scoped or...

CVE-2026-55545 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

CVE-2026-55521 Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

monitorr-exploit-toolkit

Monitorr-Exploit-Toolkit RCE über unsicheren Datei-Upload PHP-Reverse-Shell, Webshell usw. Erstellung von Administratorkonten über Autorisierungs-Bypass Technischer Informationsabfluss : Monitorr-Version, PHP-Version, Systemversion & Kernel, PHP-Konfiguration usw. Exploit für CVE-2020-28872 und...

CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Summary A user with only a single self-owned project can permanently destroy the Kanban bucket assignments taskbuckets and task ordering taskpositions of any other project view in the entire instance. The ProjectView.Delete model method runs three SQL statements: the first is properly scoped to...

GHSA-GG93-X632-9CCV Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Summary A user with only a single self-owned project can permanently destroy the Kanban bucket assignments taskbuckets and task ordering taskpositions of any other project view in the entire instance. The ProjectView.Delete model method runs three SQL statements: the first is properly scoped to...

DIR8xx_PoC

phpcgi phpcgi é responsável por processar requisições para páginas .php, .asp e .txt. Além disso, verifica se um usuário está autorizado ou não. No entanto, se uma requisição for elaborada de maneira adequada, um atacante pode facilmente contornar a autorização e executar um script que retorna um...

CVE-2025-29927

CVE-2025-29927 Elusione dell'autorizzazione del middleware di Next.js Il template di rilevamento per CVE-2025-29927 fa ora ufficialmente parte del repository Nuclei Templates. https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-29927-HEADLESS.yaml Una...

EUVD-2026-67832

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...

CVE-2026-55065 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...

CVE-2026-55065

Vikunja (open-source self-hosted task management platform) versions 0.24.6 through 2.4.0 are affected by an authorization bypass in ProjectView.Delete. The permission check (CanDelete) verifies admin status for the URL-supplied project but never confirms the view actually belongs to that project....