106051 matches found
EUVD-2026-93428
Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...
CVE-2025-29927
CVE-2025-29927 CVE-2025-29927: Next.js 미들웨어 우회 취약점 이 저장소는 Next.js에서 내부 헤더 x-middleware-subrequest를 사용하여 인증과 같은 미들웨어 검사를 우회할 수 있는 CVE-2025-29927 취약점을 보여줍니다. 영향받는 버전 Next.js 15.x 15.2.3 Next.js 14.x 14.2.25 Next.js 13.x 13.5.9 완화 및 해결 방법 Next.js를 패치된 버전으로 업그레이드하세요: Next.js 15.x 15.2.3 Next.js 14.x...
EUVD-2026-93426
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...
CVE-2026-106040
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...
CVE-2026-106041
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...
CVE-2026-106039
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...
CVE-2026-73310
CVE-2026-73310: OAuth2 redirect URI not bound to authorization code XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's...
CVE-2022-22978
CVE 2022-22978: RegexRequestMatcher에서의 인가 우회 🥶 개요 제가 조사한 정보에 따르면, 이는 Spring Security 프레임워크의 RegexRequestMatcher 클래스와 관련된 취약점입니다. 구체적으로, 정규 표현식에 마침표.가 포함된 RegexRequestMatcher를 사용하는 애플리케이션은 \r%0a , \n%0d 문자를 이용해 우회될 수 있으며, 이를 통해 공격자는 인증 없이 허용되지 않은 경로에 접근할 수 있습니다. 취약한 Spring Security 프레임워크 버전: 5.5.7...
CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-
보안 권고: 불충분한 접근 제어로 인한 무단 방 삭제 허용 Let's Chat 할당된 CVE ID: CVE-2026-66751 요약 DELETE /rooms/:room는 로그인 요구 외에는 어떠한 권한 검사도 수행하지 않습니다. 어떤 계정이든 서버의 모든 방을 보관 처리할 수 있으며, 해당 계정이 읽거나, 참여하거나, 수정할 수 없는 비공개 및 비밀번호 보호 방도 포함됩니다. 보관archiving은 Let's Chat에서 방을 삭제하는 방식입니다. 방은 방 목록에서 사라지고, 직접 조회하면 404를 반환하며, 해당 방에 메시지...
CVE-2026-106040
Mooncake Store master through version 0.3.13.post1 is susceptible to a missing authorization vulnerability (CWE-862) within the EvictDiskReplica and BatchEvictDiskReplica functions. Unauthenticated attackers capable of reaching the coro_rpc master port can evict DISK replicas across all tenants. ...
EUVD-2026-93403
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...
CVE-2026-106041 Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...
CVE-2026-106040 Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...
CVE-2026-106041
The Mooncake Store master (versions through 0.3.13.post1 ) is vulnerable to a missing authorization flaw (CWE-862) involving the NotifyOffloadSuccess RPC . This allow unauthenticated attackers to inject completed LOCAL_DISK replicas. Specifically, an attacker can mount a local disk segment using ...
EUVD-2026-93404
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...
CVE-2026-106040 Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...
CVE-2026-106040 Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...
EUVD-2026-93402
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...
CVE-2026-106039
The Mooncake Store master (through version 0.3.13.post1 ) is vulnerable to a missing authorization flaw in the replication task RPC . This vulnerability allows unauthenticated attackers to interact with the coro_rpc port to perform actions such as CreateCopyTask , CreateMoveTask , FetchTasks , an...
CVE-2026-106039 Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...