CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

CVE-2025-2539

POC - CVE-2025-2539 File Away Disclaimer : Questa prova di concetto POC è realizzata esclusivamente a scopo didattico e di test etico. L'utilizzo di questo strumento per attaccare target senza previo consenso reciproco è illegale. È responsabilità dell'utente finale rispettare tutte le leggi...

Cve-2026-39676

Cve-2026-39676 Wordpress Version: Download Manager 3.3.5.2 Titel: Fehlende Autorisierung - Nicht authentifizierter IDOR-Exploit...

CVE-2026-8237

CVE-2026-8237 CVE-2026-8237 è una vulnerabilità Insecure Direct Object Reference IDOR causata da controlli di autorizzazione mancanti in Concrete CMS 9.5.0 e versioni precedenti. Il difetto è presente nell'endpoint /ccm/frontend/conversations/messagedetail, che restituisce l'intero contenuto dei...

CVE-2026-6145

CVE-2026-6145 — User Registration & Membership per WordPress: Bypass non autenticato dell'approvazione amministrativa Exploit proof-of-concept per CVE-2026-6145 , una vulnerabilità di autorizzazione mancante nel plugin User Registration & Membership per WordPress ≤ 5.1.5 che consente agli...

siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

CVE-2026-66012 — SiYuan MCP: acquisizione dei privilegi di amministratore senza autenticazione Proof of Concept per CVE-2026-66012 CVSS 10.0 Critico, una vulnerabilità di autorizzazione mancante nell'endpoint MCP Model Context Protocol di SiYuan che consente a un attaccante non autenticato di...

CVE-2026-78204

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204

Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...

EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-8239

CVE-2026-8239 CVE-2026-8239 è una vulnerabilità Insecure Direct Object Reference IDOR che colpisce Concrete CMS 9.5.0 e versioni precedenti. La vulnerabilità è presente nell'endpoint /ccm/frontend/conversations/getrating, che consente a un attaccante di determinare se un messaggio di conversazion...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

CVE-2025-30772

🚨 CVE-2025-30772 - Escalation dei privilegi in WPC Smart Upsell Funnel for WooCommerce 📅 Pubblicato: 27 marzo 2025 🔐 Punteggio CVSS: 8.8 Alto 🔥 CWE-862: Autorizzazione mancante 🐞 Riepilogo della vulnerabilità Una vulnerabilità di Autorizzazione mancante nel plugin WPC Smart Upsell Funnel for...

CVE-2025-34171

CVE-2025-34171: Esposizione non autenticata di file e dati di debug in CasaOS Panoramica della vulnerabilità Campo| Valore ---|--- ID CVE| CVE-2025-34171 Interessa| CasaOS ≤ 0.4.15 Corretto in| Nessuna patch disponibile Gravità| Media CVSS 4.0|...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...