7979 matches found
CVE-2026-16214 geex-arts django-jet Dashboard views.py authorization
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and...
EUVD-2026-45425
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and...
CVE-2026-16214
CVE-2026-16214 affects geex-arts django-jet up to version 1.0.8, specifically the Dashboard Module’s jet/dashboard/views.py component. The documentation reports an authorization bypass vulnerability caused by manipulation of an unknown function, with remote exploitation possible and a publicly av...
PT-2026-61048
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and...
GO-2026-6012 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container in github.com/nuclio/nuclio
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container in github.com/nuclio/nuclio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2026-10525
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting...
CVE-2026-10525
The CVE-2026-10525 entry concerns the NEX-Forms WordPress plugin prior to version 9.2.3. The root cause is insufficient sanitization and escaping of submitted form data before storing it and when rendering it in the admin dashboard. This results in a Stored XSS vulnerability that could allow unau...
GHSA-WPCJ-RMV4-86QG Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
Summary Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which splits on : only — no path validation is applied to the module portion. During function build,...
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
Summary Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which splits on : only — no path validation is applied to the module portion. During function build,...
SUSE CVE-2026-8595
A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting...
EUVD-2026-44924
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...
PT-2026-60683
Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.16.5 Description An unauthenticated path traversal issue exists in the Nuclio Dashboard when operating in NOP authentication mode. The POST /api/functions endpoint does not properly validate the spec.handler field,...
CVE-2026-49352 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an authtoken cookie when...
CVE-2026-45320
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as $deptId are processed by SqlparserUtils.transFilter, whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace"$var", valu...
CVE-2026-45320 DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as $deptId are processed by SqlparserUtils.transFilter, whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace"$var", valu...
CVE-2026-45320 DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as $deptId are processed by SqlparserUtils.transFilter, whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace"$var", valu...
CVE-2026-45320
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as $deptId are processed by SqlparserUtils.transFilter, whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace"$var", valu...
CVE-2026-45320
DataEase (open source data visualization/analysis tool) is affected by an SQL injection in dashboard variables. Prior to version 2.10.23, dashboard SQL variables (e.g., ${deptId}) are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between o...
CVE-2026-46485
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized...
CVE-2026-46485
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized...