CVE-2026-22683

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

CVE-2026-22683

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

CVE-2026-22683

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

CVE-2026-22683: Missing Authorization

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

PT-2026-30913

Name of the Vulnerable Software and Affected Versions Windmill versions 1.56.0 through 1.614.0 Description Windmill versions 1.56.0 through 1.614.0 have a missing authorization vulnerability. Users with the Operator role can perform prohibited entity creation and modification actions via the...

@cubejs-backend/server (>=1.5.0, <=1.5.12), @cubejs-backend/server-core (>=1.5.0, <=1.5.12) +1 more potentially affected by CVE-2026-25958 via @cubejs-backend/api-gateway (>=1.5.0, <=1.5.12)

@cubejs-backend/api-gateway NPM version =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.12 Source cves: CVE-2026-25958 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265447...

@codefresh-io/cubejs-backend-server-core (>=0.30.77, <=0.35.49), @cubejs-backend-json-clone/server (1.0.0) +14 more potentially affected by CVE-2026-25958 via @cubejs-backend/api-gateway (>=0.27.53, <=1.0.12)

@cubejs-backend/api-gateway NPM version =0.27.53, =0.30.77, =0.27.0, =0.27.0, =0.27.0, =0.27.0, =0.27.0, =0.32.28, =0.29.4, =1.0.0, =0.27.30, =0.30.61, =0.32.0, =0.33.8 and more Source cves: CVE-2026-25958 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265447...

@cubejs-backend/server (>=1.1.0, <=1.4.0), @cubejs-backend/server-core (>=1.1.0, <=1.4.0) +2 more potentially affected by CVE-2026-25958 via @cubejs-backend/api-gateway (>=1.1.0, <=1.4.0)

@cubejs-backend/api-gateway NPM version =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.4.0 - cubejs-backend-server-core-fork 1.1.3 Source cves: CVE-2026-25958 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265447...

@cubejs-backend/server (>=1.1.17, <=1.4.0), @cubejs-backend/server-core (>=1.1.17, <=1.4.0) +1 more potentially affected by CVE-2026-25957 via @cubejs-backend/api-gateway (>=1.1.17, <=1.4.0)

@cubejs-backend/api-gateway NPM version =1.1.17, =1.1.17, =1.1.17, =1.1.17, =1.4.0 Source cves: CVE-2026-25957 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265448...

Nextcloud: Public collectives allow to create pages

A vulnerability was discovered in the Nextcloud Collectives application that allowed non-members accessing a public collective to create new pages through the backend API, bypassing the collective-level permission settings configured to restrict editing to administrators only. The vulnerability w...

CVE-2026-24428

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an...

UNIX Symbolic Link (Symlink) Following

Overview @backstage/backend-plugin-api is a Core API used by Backstage backend plugins Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the resolveSafeChildPath function, which relies on resolveRealPath. An attacker can access sensitive files outside the...

CVE-2026-23754 D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary userid value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credentia...

CVE-2026-23754

CVE-2026-23754 affects D-Link D-View 8, versions 2.0.1.107 and earlier. The Red Hat, CIRCL, NVD, and CVE listings describe an improper access control vulnerability in backend API endpoints: any authenticated user can supply an arbitrary user_id to retrieve sensitive credential data belonging to o...

CVE-2026-23754 D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary userid value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credentia...

CVE-2026-23754: Authorization Bypass Through User-Controlled Key

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary userid value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credentia...

CVE-2025-36228: Incorrect Execution-Assigned Permissions

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse...

CVE-2025-41112

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros2.php'...

CVE-2025-41340

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'idtpdenuncia' and 'idsociedad' in '/backend/api/buscarTipoDenunciabyId.php'...