9480 matches found
Exploit for Improper Authorization in Vercel Next.Js
CVE-2025-29927 ā Next.js Middleware Authorization Bypass Verif...
PT-2026-86359
šØ CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbound...
CVE-2026-18175
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...
CVE-2026-17627
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
CVE-2026-16941
IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization...
EUVD-2026-71483
IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization...
CVE-2026-16941
IBM i versions 7.6, 7.5, and 7.4 (license product 5770-SS1 ) are affected by an incorrect authorization flaw (CWE-863 ) that allows a remote authenticated attacker to modify certain system messages , resulting in a limited integrity impact (CVSS 4.3, MEDIUM). No confidentiality or availability im...
CVE-2026-17627
IBM Langflow OSS (versions 1.0.0ā1.10.2) is affected by an improper authorization flaw (CWE-639) in its voice-mode WebSocket endpoint . The endpoint authenticates the connecting user but performs no check to verify that the user is permitted to access the specified flow identifier. In a multi-use...
CVE-2026-17627 Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
CVE-2026-17627 Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
EUVD-2026-71466
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
EUVD-2026-71458
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...
CVE-2026-18175 IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher...
CVE-2026-18175
IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by an improper authorization flaw (CWE-285) in the DDM target dispatcher component of Distributed Data Management. A remote attacker with no prior access could manipulate database transactions , resulting in high integrity impact and low confiden...
Improper Authorization
Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...
EUVD-2026-70807
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARECMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARECMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary address...
EUVD-2026-70817
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...
PT-2026-85770
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
CVE-2026-75165: Improper Authorization
An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods ugw-ping, ugw-traceroute that are not exposed in the web UI, allowing attackers to obtain sensitive...