115592 matches found
CVE-2026-113606
Stirling-PDF versions 3.0.0 through 3.2.0 are vulnerable to an authorization bypass (CWE-639) within the processing folders functionality. Authenticated users can access files belonging to other users by pointing a processing folder at the server storage directory via a POST /api/v1/processing-fo...
EUVD-2026-105169
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...
CVE-2026-113603 x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...
CVE-2026-113603
The x402 SIWX server extension contains an authorization bypass vulnerability in @x402/extensions (versions 2.3.1 through 2.28.0), x402 PyPI (versions 2.11.0 through 2.25.0), and the Go module (versions 2.16.0 through 2.28.0). The root cause allows paying clients to unlock unpaid routes by provid...
CVE-2026-113601
Versions of Memos prior to 0.27.0 are vulnerable to a missing authorization flaw in the ActivityService ListActivities and GetActivity API methods. This vulnerability allows authenticated users to view activity records from all other users by enumerating sequential activity IDs. Impacted data inc...
EUVD-2026-105167
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...
CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...
EUVD-2026-105162
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...
CVE-2026-113595
Sharkord versions prior to 0.0.26 are vulnerable to a missing authorization flaw in the others.changeLogo tRPC mutation. This vulnerability allows any authenticated member to modify the server logo without possessing the required MANAGE_SETTINGS permission. An attacker can exploit this to remove ...
EUVD-2026-105161
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...
EUVD-2026-105160
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...
EUVD-2026-105159
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...
CVE-2026-113359
The Baserow application before version 2.3.0 is vulnerable to a missing authorization flaw in the unique_row_values API endpoint. This vulnerability allows any authenticated user to perform a cross-workspace data disclosure by enumerating sequential field IDs. An attacker can successfully retriev...
CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...
CVE-2026-113594
Sharkord versions before 0.0.8 are vulnerable to a missing authorization flaw in the others.updateSettings tRPC mutation. This allows any authenticated member to modify server-wide settings without the required MANAGE_SETTINGS permission. Exploitation can lead to a denial of service by allowing a...
CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...
CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...
CVE-2026-113411
A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The...
CVE-2026-112834
Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...