530 matches found
CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...
EUVD-2026-86550
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124464)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124464 advisory. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain...
CVE-2026-61834: Improperly Controlled Modification of Dynamically-Determined Object Attributes
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...
CVE-2026-56595: Permissive Cross-domain Policy with Untrusted Domains
HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and...
tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API
A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication formerly JASPIC ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process...
CVE-2026-85408: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/ /events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack...
CVE-2026-84430: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes...
CVE-2026-47849: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....
CVE-2026-59284: Improperly Controlled Modification of Dynamically-Determined Object Attributes
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...
CVE-2026-47850: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...
CVE-2026-77144: Improperly Controlled Modification of Dynamically-Determined Object Attributes
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...
CVE-2026-71473: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A flaw was found in the search-v2-operator component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container...
CVE-2026-17598: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...
CVE-2026-15083: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4...
CVE-2026-55804: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.,...
CVE-2026-55803: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.,...
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the processing of Exchange headers that are not prefixed with 'Camel', which bypasses the HeaderFilterStrategy. An attacker can override operations by...
CVE-2026-12577
CVE-2026-12577 affects DVP80ES3 and is due to an improperly implemented security check for a standard vulnerability. The NVD entry lists a CVSS v4.0 base score of 8.7 (HIGH): network attack vector, low attack complexity, no user interaction required. Impacts: availability HIGH, confidentiality/in...