EUVD-2026-81046

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92752 metasfresh Unauthorized Access via Document Attachments and Comments Endpoints

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role...

CVE-2026-92469

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92469 microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92469 microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92469

CVE-2026-92469 affects zlt2000 microservices-platform through 6.0.0 , specifically the file-center module . The DELETE /files/{id} endpoint performs no ownership validation, allowing any authenticated attacker to enumerate file identifiers via GET /files and subsequently delete other users' files...

EUVD-2026-80707

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92469 microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

EUVD-2026-80667

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

CVE-2026-27560

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27560 Command Injection via DELETE in /api/status/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27560 Command Injection via DELETE in /api/status/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27560

CVE-2026-27560 is a command injection vulnerability in the /api/status/data endpoint, where a remote attacker with admin credentials can send a crafted DELETE request to execute arbitrary commands with root privileges on the device. The CVSS v3.1 score is 7.2 (HIGH) with a vector of AV:N/AC:L/PR:...

EUVD-2026-80243

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93589

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv BLA Border Gateway Advertisement component during the deletion of a mesh interface. The function batadv bla del backbone claims called via batadv bla...

PT-2026-93706

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description Insufficient authorization checks in the CrmFlowController deleteFlowStep function allow any authenticated back-office user to delete arbitrary approval workflow steps. This can be achieved by...

PT-2026-94029

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description A flaw in the file management function of the web-based management interface allows an authenticated remote attacker with administrative...

PT-2026-93774

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Libraries Plugin versions prior to 805.va fc79344957d Description An issue exists where the library path provided to the library Pipeline step is not restricted to a relative path within the SCM checkout. Additionally,...

PT-2026-94080

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.6.17 Description The mass subscriber removal form handler fails to validate cross-site request forgery CSRF tokens. CSRF is a type of attack that tricks a victim into submitting a malicious request. This allows...

PT-2026-93862

Name of the Vulnerable Software and Affected Versions ContiNew Admin versions prior to 4.1.1 Description An authorization bypass exists in the personal message delete endpoint. Authenticated users can delete messages and announcements belonging to other users by providing arbitrary message...