66565 matches found
CVE-2026-59704
Cap’s GET /api/video/ai endpoint lacks proper ownership/membership validation, exposing private video AI metadata (titles, summaries, chapters) and enabling authenticated attackers to solicit arbitrary video IDs to read sensitive content. This may also trigger unauthorized AI generation that depl...
CVE-2026-46700
Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through a race condition in the authorizationcode grant handler. An attacker can obtain multiple valid access,...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through a race condition in the authorizationcode grant handler. An attacker can obtain multiple valid access...
CVE-2026-53730
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute...
CVE-2026-48957
An improper access check allows unauthorized users to access comprivacy datasets...
CVE-2026-48955
An improper access check allows unauthorized users to access workflow stage and transition information...
CVE-2026-48955
An improper access check allows unauthorized users to access workflow stage and transition information...
CVE-2026-48956
An improper access check allows users to display a list of modules in the frontend...
CVE-2026-48956
An improper access check allows users to display a list of modules in the frontend...
CVE-2026-48948
An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...
CVE-2026-48948
An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...
CVE-2026-48947
An improper access check allows privileged users to overwrite media files without editing permissions...
CVE-2026-48947
An improper access check allows privileged users to overwrite media files without editing permissions...
EUVD-2026-42069
An improper access check allows privileged users to overwrite media files without editing permissions...
EUVD-2026-42068
An improper access check allows unauthorized users to create custom fields via webservices endpoints...
CVE-2026-48955
An improper access check allows unauthorized users to access workflow stage and transition information...
CVE-2026-48955 Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
An improper access check allows unauthorized users to access workflow stage and transition information...