27 matches found
CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...
CVE-2026-68559
Wekan (open-source kanban board built with Meteor) is affected by a broken access control vulnerability in the /api/boards/:boardId/exportExcel route (versions 9.57 through 9.74 ). The root cause is that the asynchronous exporterExcel.canExport(user) authorization guard in models/server/ExporterE...
EUVD-2026-62700
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...
CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...
CVE-2026-53447 Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport or checking source-board membership. Any authenticated user who kno...
EUVD-2025-9994
Malicious code in bioql PyPI...
EUVD-2024-41258
Malicious code in bioql PyPI...
EUVD-2021-8050
Malicious code in bioql PyPI...
EUVD-2024-41259
Malicious code in bioql PyPI...
CVE-2021-20632
Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Bulletin Board via unspecified vectors...
CVE-2025-21438
Memory corruption while IOCTL call is invoked from user-space to read board data...
CVE-2025-21440
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver...
CVE-2025-21438
Memory corruption while IOCTL call is invoked from user-space to read board data...
ALPINE-CVE-2025-21441
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver...
CVE-2025-21441
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver...
CVE-2025-21441
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver...
Qualcomm Chipsets 缓冲区错误漏洞
Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A buffer error vulnerability exists in Qualcomm Chipsets, which originates from a memory corruption that occurs when IOCTL is called from user space to read board data...
Qualcomm Chipsets 缓冲区错误漏洞
Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A buffer error vulnerability exists in Qualcomm Chipsets that originates from a memory corruption that occurs when writing board data from a user-space call to IOCTL...
Qualcomm Chipsets 缓冲区错误漏洞
Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A buffer error vulnerability exists in Qualcomm Chipsets that stems from a potential memory corruption when reading board data via IOCTL calls...