CVE-2026-100409

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

EUVD-2026-102200

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-97665

A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages .snupkg to a hosted repository, bypassing the write-permission check enforced for ordinary packag...

10up Distributor authorization issue vulnerability

The 10up Distributor versions prior to 2.3.2 have an authorization issue vulnerability. This vulnerability stems from the lack of authorization verification in the ajaxpush function. It allows contributor-level multi-site users to use dt-push nonce along with the selected connection ID and...

OtterMind Nubase Authorization Issue Vulnerability

OtterMind Nubase versions 0.1.4 and earlier have an authorization issue vulnerability. This vulnerability stems from the fact that /storage/v1/object/bucketId/path is treated as public for all HTTP methods, without proper authentication. This allows unverified attackers to download objects from...

IBM i Authorization Issues Vulnerabilities

Versions of IBM i such as 7.3, 7.4, 7.5, and 7.6 have authorization-related vulnerabilities. These vulnerabilities stem from improper validation of transaction identifiers provided to attackers, which could allow unauthorized remote attackers to manipulate distributed transactions...

MariaDB Server Authorization Issue Vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a vulnerability related to authorization. This vulnerability stems from the GRANT PROXY statement treating an IDENTIFIED clause with an...

Dokan Multivendor Marketplace Authorization Issues Vulnerability

The Dokan Multivendor Marketplace versions 5.2.1 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of validation for user control keys via the 'password' parameter, making it vulnerable to insecure direct object reference attacks. This could allow...

Zou Jingli: ThinkLibrary for ThinkAdmin – Authorization Issues Vulnerability

Zou Jingli: The ThinkLibrary for ThinkAdmin versions 1.0.81 and earlier have an authorization issue vulnerability. This vulnerability stems from an insecure direct object reference in the admin/file.edit function. Non-super administrators who own that node can read or overwrite other...

Mattermost authorization issue vulnerabilities

Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.7.9 and earlier of 11.7.x series, 11.9.1 and earlier of 11.9.x series, and 11.8.5 and earlier of 11.8.x series have an authorization issue vulnerability. This vulnerability stems from the fact that the endpoint for switching account...

IoTSharp authorization issue vulnerability

IoTSharp 3.6.1 and earlier versions have an authorization issue vulnerability. This vulnerability arises from the fact that the Customers and Devices API handlers do not limit the query scope to the caller’s tenant. There is a potential for insecure direct object references. Attackers can registe...

Vastxie 99AI Authorization Issue Vulnerability

Vastxie 99AI versions 4.3.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authentication in the POST /api/chatLog/exportExcel route, which may allow unauthenticated attackers to export xlsx files containing the username, email, prompt words, and ...

Moul SSHPortal authorization issue vulnerability

Moul SSHPortal versions 1.19.5 and earlier have an authorization vulnerability. This vulnerability stems from the lack of authorization in the 'key show' command used in the management shell. It may allow authenticated non-administrator users to obtain decrypted backend private SSH keys. These ke...

Getrebuild Rebuild authorization issue vulnerability

Getrebuild Rebuild 4.5.0 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization checks in the TaskCommentController.commentList component. It allows authenticated, low-privilege users to read task comments without having project membership. Attacke...

Netcore NR256CN Authorization Issue Vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have an authorization issue vulnerability. This vulnerability stems from adding a public routing prefix to URIs, which can bypass authentication. Unauthenticated attackers can access protected management CGI handlers through routes with the .ico...

WordPress WP Map Block authorization issue vulnerability

WordPress WP Map Block 3.0.0 and earlier versions have an authorization issue. This issue stems from the lack of capability checks in the MapsController REST controller’s setstatus and bulk functions. The permission callback canedit only validates editposts; no object-level ownership checks or...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue vulnerability. This vulnerability stems from the write processing program skipping department checks, allowing unauthorized access. Attackers with the user:edit or user:del permissions can send PUT or DELETE requests to /api/users,...

gz-yami Mall4cloud Authorization Issue Vulnerability

gz-yami Mall4cloud versions 4.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the improper handling of the orderAddrId parameter in the getOrderAddr processing routine of the multishop OrderController. There is a security vulnerability involving direct objec...

IBM i Authorization Issues Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have authorization-related vulnerabilities. These vulnerabilities stem from improper execution of the boot version flag, which may allow local attackers to bypass NFS version restrictions...

Smartloli EFAK authorization issue vulnerability

In versions 5.0.0 to 5.1.0 of smartloli EFAK, there is an authorization issue. This vulnerability stems from a lack of authorization checks. Certified low-privilege users can access the LLM provider’s API keys through the/api/model-config REST API, which may lead to unauthorized access and...