114376 matches found
PT-2026-109907
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the importExcel handler of the SysCategoryController. This issue allows any authenticated user, including those with low privileges, to upload specially crafted Exce...
CVE-2026-108640: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes,...
CVE-2026-40802: Missing Authorization
Subscriber Settings Change in Pubjet | پابجت = 5.4.8 versions...
CVE-2026-108604: Incorrect Authorization
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-108642: Authorization Bypass Through User-Controlled Key
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite...
auto-repeater
AutoRepeater: Ripetizione automatica delle richieste HTTP con Burp Suite tl;dr All'interno di Extender importa AutoRepeater.jar Alcune brevi istruzioni AutoRepeater reinvierà solo le richieste modificate da una sostituzione definita. Quando AutoRepeater riceve una richiesta che corrisponde alle...
CVE-2026-107851
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...
EUVD-2026-78651
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project...
EUVD-2026-78654
Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts...
EUVD-2026-51992
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA...
GHSA-V3P6-34MC-HJ7V Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...
CVE-2026-107851
The Contao Open Source CMS (versions 5.7.0 through 5.7.12) contains an improper access control vulnerability in the TableAccessVoter::hasAccessToModule() function located in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php. The root cause is that the voter caches authorization de...
CVE-2026-106398
An incorrect authorization flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/543082212...
CVE-2026-106271
A missing authorization flaw was found in the Workers component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553118313...
CVE-2026-106212
An incorrect authorization flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/540072162...
CVE-2026-106307
An incorrect authorization flaw was found in the Network component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/537832408...
WordPress AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin AutomatorWP versions = 5.8.4...