CVE-2025-12817 PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before...

PT-2025-46811

Name of the Vulnerable Software and Affected Versions YOP Poll versions through 6.5.38 Description An authorization issue exists in YOP Poll, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update YOP Poll to a version later than 6.5.38...

PT-2025-46810

Name of the Vulnerable Software and Affected Versions codepeople Contact Form Email versions through 1.3.58 Description An authorization issue exists in codepeople Contact Form Email, allowing exploitation of incorrectly configured access control security levels. Recommendations Update to a versi...

PT-2025-46801

Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through = 23.2...

mall-swarm 授权问题漏洞

mall-swarm is a microservice mall system. There is an authorization issue vulnerability in mall-swarm, which originates from the improper handling of the orderId parameter in the cancelUserOrder function in the file /order/cancelUserOrder, and no detailed vulnerability details are provided...

mall-swarm 授权问题漏洞

mall-swarm is a microservice mall system. There is an authorization issue vulnerability in mall-swarm, which originates from the mishandling of the orderId parameter in the cancelOrder function in the file /order/cancelOrder, and no detailed vulnerability details are provided...

PT-2025-46808

Name of the Vulnerable Software and Affected Versions QuantumCloud ChatBot versions through 7.3.9 Description An authorization issue exists in QuantumCloud ChatBot that allows exploitation of incorrectly configured access control security levels. Recommendations Update QuantumCloud ChatBot to a...

CVE-2025-64403 Apache OpenOffice: Remote documents loaded without prompt via "external data sources" in Calc

Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links to be loaded without prompt. This issue affects Apache...

sudo-rs 授权问题漏洞

sudo-rs is an open source in-memory security implementation of sudo and su by Trifecta Tech Foundation. An authorization issue vulnerability exists in sudo-rs version 0.2.5 through versions prior to 0.2.10, which stems from improperly logged authentication timestamps and could lead to bypassing...

WordPress plugin Astra Security Suite – Firewall & Malware Scan 授权问题漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An authorization issue vulnerability exists in the WordPress plugin Astra Security Suite -...

Hundred Plus EIP Plus 授权问题漏洞

Hundred Plus EIP Plus is an enterprise management software from Hundred Plus Ares Taiwan, China. Hundred Plus EIP Plus suffers from an authorization issue vulnerability that stems from a weak password recovery mechanism, which could allow an unauthenticated, remote attacker to predictably or...

Kubevirt 授权问题漏洞

Kubevirt is an open source virtual machine manager from KubeVirt. An authorization issue vulnerability exists in Kubevirt versions prior to 1.5.3 and prior to 1.6.1, which stems from a flaw in the peer validation logic in virt-handler, which could allow an attacker to impersonate the virt-api and...

WordPress plugin IDonate – Blood Donation, Request And Donor Management System 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An authorization issue...

CVE-2025-62914: Missing Authorization

Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through = 1.2.1...

WordPress plugin Better Find and Replace – AI-Powered Suggestions 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin... An authorization iss...

CVE-2025-43498

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1. An app may be able to access sensitive user data...

CVE-2025-43498

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1. An app may be able to access sensitive user data...

CVE-2025-43498

An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, visionOS 26.1. An app may be able to access sensitive user data...

CVE-2025-43498

An authorization issue exists in Apple's FileProvider component, where improved state management was required to prevent an app from accessing sensitive user data . This vulnerability affects iOS 26.1 , iPadOS 26.1 , macOS Sequoia 15.7.2 , macOS Sonoma 14.8.2 , macOS Tahoe 26.1 , and visionOS 26....

CVE-2025-43498

An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, visionOS 26.1. An app may be able to access sensitive user data...