16126 matches found
PT-2026-27466
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response dat...
Linux Distros Unpatched Vulnerability : CVE-2026-33186
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2...
OpenClaw Authorization Bypass Vulnerability (CNVD-2026-14835)
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an authorization bypass vulnerability that stems from the system accepting variable sender display names instead of forcing an ID-only match. An attacker could use this vulnerability to bypass...
OpenClaw has an unspecified vulnerability (CNVD-2026-14834)
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw has a security vulnerability that stems from not enforcing dmPolicy and allowFrom authorization checks on Discord direct message response notifications, which can be exploited by an attacker to bypass DM...
OpenClaw Authorization Bypass Vulnerability (CNVD-2026-14837)
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an authorization bypass vulnerability that stems from the system incorrectly treating DM paired stored identities as group allowlist identities when dmPolicy is set to pairing and groupPolicy is set to...
OpenClaw Authorization Bypass Vulnerability (CNVD-2026-14841)
OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an authorization bypass vulnerability that is due to an authorization bypass vulnerability in the WebSocket connection path. An attacker can exploit the vulnerability to perform administrator-only...
Parse Server 授权问题漏洞
Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were authorization-related vulnerabilities in versions of Parse Server prior to 8.6.52 and 9.6.0-alpha.41. These vulnerabilities stemmed from authentication...
CVE-2026-4056
The CVE-2026-4056 entry concerns the WordPress plugin “User Registration & Membership.” The vulnerability arises from a missing capability check in the Content Access Rules REST API endpoints, where the code path only validates the edit_posts permission instead of an administrator-level capabilit...
CVE-2026-32911
Rejected reason: This CVE ID has been rejected...
CVE-2026-32904
Rejected reason: This CVE ID has been rejected...
CVE-2026-32900
Rejected reason: This CVE ID has been rejected...
CVE-2026-32911
OpenClaw versions 2026.2.22 before 2026.2.24 contain an authorization bypass in the synology-chat channel plugin. The root cause is dmPolicy set to allowlist with empty allowedUserIds that fails open, allowing attackers with Synology sender access to bypass authorization checks and dispatch unaut...
CVE-2026-32904
OpenClaw is affected by an authorization bypass vulnerability (CVE-2026-32904) present in versions before 2026.2.26. The issue occurs in group allowlist policy evaluation, which incorrectly accepts sender identities from DM pairing-store approvals, allowing an attacker to bypass group allowlist c...
CVE-2026-32900
OpenClaw CVE-2026-32900 affects versions prior to 2026.2.22. The vulnerability is an authorization bypass in allowlist mode due to allow-always persistence at the wrapper level, enabling approval-bypass execution of different payloads. This allows attackers to approve benign wrapped system.run co...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the profile update. An attacker can modify arbitrary user information, including passwords, by accessing the affected functionality as an authenticated user. This may lead to...
GO-2026-4804 Ory Oathkeeper has a path traversal authorization bypass in github.com/ory/oathkeeper
Ory Oathkeeper has a path traversal authorization bypass in github.com/ory/oathkeeper...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the task comments process. An attacker can access unauthorized comment data by manipulating identifiers in API requests. Remediation Upgrade code.vikunja.io/api/pkg/models to version...