CVE-2026-84205

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-84204

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

Khan Academy: Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset Endpoint

A client-side denial of service vulnerability was identified on a password reset endpoint. When the endpoint was accessed by an authenticated user, the browser automatically generated thousands of requests without user interaction, resulting in rapid memory exhaustion. The browser became...

CVE-2026-84205 GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

EUVD-2026-69292

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-84204 GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

CVE-2026-84204 GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

CVE-2026-84204 GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

EUVD-2026-69291

GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy

CVE-2024-55591 - Fortinet FortiOS Authentication Bypass An ed...

SUSE CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

CVE-2026-84147

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system...

CVE-2026-84148

This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users o...

CVE-2026-53682

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles security domain topology and participating subsystems, without requiring a principal, client certificate, or...

CVE-2026-84148 Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users o...

CVE-2026-84148 Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users o...

EUVD-2026-69057

This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users o...

CVE-2026-84148

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Manacle Technologies ERP System . The root cause is improper authentication and authorization controls in an API endpoint, allowing an unauthenticated remote attacker to manipulate a parameter and expose sensitive information...

EUVD-2026-69056

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles security domain topology and participating subsystems, without requiring a principal, client certificate, or...

CVE-2026-84147 Remote Code Execution Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system...