23838 matches found
EUVD-2026-65078
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...
Vulnerabilities present in Atlassian products
Atlassian has hidden vulnerabilities in various products such as Bamboo, Bitbucket, Confluence, Jira, Crowd, and Fisheye. These vulnerabilities exist in various third-party products for which updates have already been released. Atlassian has incorporated these updates into its own products...
PT-2026-80862
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting company i...
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and...
The vulnerability of the Audio/Video component in the Firefox web browser and the Thunderbird email client allows attackers to access confidential data and influence its integrity.
The vulnerability of the Audio/Video component in the Firefox web browser and the Thunderbird email client is related to dependencies on unspecified behaviors for each type of implementation. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data and affect...
The vulnerability in the Firefox web browser and Thunderbird email client, related to data type conversion errors, allows attackers to access confidential data.
The vulnerability in the Firefox web browser and Thunderbird email client is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...
The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules allows attackers to access confidential data.
The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...
CVE-2026-12710: Missing Authorization
A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration versions from 2025-04-28 to 2026-04-04 allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required...
K000163021: Oracle Java vulnerabilities CVE-2026-47057, CVE-2026-47058, CVE-2026-47063, CVE-2026-60147
Security Advisory Description CVE-2026-47057 Vulnerability in Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to...
Oracle VM VirtualBox (August 2026 CSPU)
The 7.2.14 versions of VM VirtualBox installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14...
Oracle Business Intelligence Enterprise Edition (OAS 8.2) (August 2026 CSPU)
The version of Oracle Business Intelligence Enterprise Edition OAS 8.2.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API...
Oracle Business Intelligence Enterprise Edition (12.2.1.4) (August 2026 CPU)
The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the August 2026 CPU advisory. - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component:...
Oracle Primavera P6 Enterprise Project Portfolio Management (August 2026 CSPU)
The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host is affected by a vulnerability as referenced in the August 2026 CSPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineerin...
CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...
OpenJDK: Enhance HTTP Connections (2026-08 Security Update)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...
GHSA-6X92-6VX4-5FWR django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...
CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...
