CVE-2026-106040

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...

CVE-2026-106039

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...

CVE-2026-106041

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

EUVD-2026-93403

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...

CVE-2026-106040

Mooncake Store master through version 0.3.13.post1 is susceptible to a missing authorization vulnerability (CWE-862) within the EvictDiskReplica and BatchEvictDiskReplica functions. Unauthenticated attackers capable of reaching the coro_rpc master port can evict DISK replicas across all tenants. ...

CVE-2026-106041 Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106041

The Mooncake Store master (versions through 0.3.13.post1 ) is vulnerable to a missing authorization flaw (CWE-862) involving the NotifyOffloadSuccess RPC . This allow unauthenticated attackers to inject completed LOCAL_DISK replicas. Specifically, an attacker can mount a local disk segment using ...

CVE-2026-106040 Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...

EUVD-2026-93404

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106039

The Mooncake Store master (through version 0.3.13.post1 ) is vulnerable to a missing authorization flaw in the replication task RPC . This vulnerability allows unauthenticated attackers to interact with the coro_rpc port to perform actions such as CreateCopyTask , CreateMoveTask , FetchTasks , an...

EUVD-2026-93402

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...

CVE-2026-106039 Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...

CVE-2026-35273

🚨 CVE-2026-35273 - Ejecución Remota de Código Sin Autenticación en Oracle PeopleSoft PeopleTools ⚠️ RCE Crítica Sin Autenticación en Oracle PeopleSoft PeopleTools Una vulnerabilidad que afecta a Oracle PeopleSoft Enterprise PeopleTools y permite a atacantes remotos comprometer sistemas vulnerables...

CVE-2025-2907

CVE-2025-2907 Exploit Detalles Publicado : 2025-04-04 Actualizado : 2025-03-28 Gravedad : Crítico Puntuación CVSS: 9.8 CWE : CWE-862: CWE-862 Falta de autorización Versiones afectadas : Todas las versiones desde n/a hasta 12.3.1 Investigador :...

CVE-2026-51119

CVE-2026-51119 - Escalada de Privilegios en Invixium IXM WEB v2.3.85.25 Descripción General Existe una vulnerabilidad de escalada de privilegios en Invixium IXM WEB v2.3.85.25 debido a la falta de comprobaciones de autorización en el endpoint POST /SystemUsers/CreateAppUser. Un usuario autenticad...

CVE-2023-26035

CVE-2023-26035 RCE no autenticado en ZoneMinder Snapshots - Exploit PoC alt img Descripción Las versiones de ZoneMinder anteriores a 1.36.33 y 1.37.33 son vulnerables a la ejecución remota de código no autenticada debido a la falta de controles de autorización en la acción de snapshot. Uso git...

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Falta de autorización para configuración de API no autenticada/Actualización arbitraria de opciones/Creación de usuario administrador...

CVE-2022-36539

CVE-2022-36539 Referencia Directa Insegura a Objetos IDOR WeDayCare B.V. WeDayCare B.V Ouderapp anterior a v1.1.22 permite a los atacantes alterar el valor del ID en llamadas interceptadas para obtener acceso a los datos de otros padres e hijos. El tráfico con la API se hace transparente a través...

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...