CVE-2025-25618

CVE-2025-25618 Unifiedtransform v2.0 は、不正なアクセス制御（Incorrect Access Control）の脆弱性が存在し、教師がセクション名（Section Name）と部屋番号（Room Number）を変更できてしまいます。これらの操作は管理者のみに制限されるべきものです。 ベンダー: Unifiedtransform PoC 手順 1: 教師としてアプリケーションにログインします。 手順 2: 以下のエンドポイントにアクセスします: /section/edit/1 手順 3: セクション名（Section Name）と部屋番号（Room...

EUVD-2026-70032

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...

CVE-2026-81427

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2024-10542

CVE-2024-10542 和 CVE-2024-10781 的 PoC：CleanTalk 插件（版本 = 6.43.2）中的认证绕过漏洞 免责声明： 本文档中关于 CVE-2024-10542 的信息仅供学习和教育目的。我们不鼓励或授权将此信息用于任何有害目的，包括但不限于漏洞利用、系统篡改或其他非法活动。 简介： 在日益复杂的数字环境中，确保网站安全对许多站点所有者至关重要。最近，发现两个严重漏洞，对 WordPress 站点构成重大威胁。这些漏洞影响知名的 CleanTalk 插件，该插件提供垃圾邮件防护、反垃圾邮件功能和防火墙。情况为何更加紧迫？让我们深入探讨！ 跟踪为...

CVE-2026-8347

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...

CVE-2026-55867

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

EUVD-2026-68014

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

CVE-2026-50152

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...

CVE-2026-81668

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2026-41262

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

PT-2026-82368

Name of the Vulnerable Software and Affected Versions Drupal Blazy versions 0.0.0 through 3.0.18 Description An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not...

CVE-2026-79788

Dradis Community Edition versions 5.1.0 through 5.2.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability (CVSS 7.1, HIGH). The root cause is that ProvidersController and AgentsController gate their admin_required authorization on defined?(Dradis::Pro), a constant never defined in ...

CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

EUVD-2026-64890

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-76238 stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

CVE-2026-76236 stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

CVE-2026-48744

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-48744

Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.py can incorrectly authorize unauthenticated GraphQL requests. The flaw permits anonymous callers to use the channelUpdate mutation to change channel order...

CVE-2026-68582

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

EUVD-2026-51992

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...