CVE-2026-108606

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the AiOcrController deleteById handler. This allows any authenticated user to delete OCR records. An attacker with low privileges can first retrieve record IDs from the unguarded GET /airag/ocr/list endpoint and...

CVE-2026-108605

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability in the AiOcrController updateById handler. This flaw allows any authenticated user to send PUT requests to the /airag/ocr/edit endpoint. An attacker can exploit this to overwrite LLM prompts in the shared air...

EUVD-2026-96431

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

EUVD-2026-96376

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2...

EUVD-2026-96378

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

EUVD-2026-96364

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581

TencentCloud Octop versions through 1.0.2b6 are vulnerable to a missing authorization flaw (CWE-862). Authenticated users with low privileges can access the GET /api/providers and GET /api/voice/providers endpoints, which only validate the JWT without sufficient permission checks. This allows att...

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108547

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

CVE-2026-108549

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...

EUVD-2026-96344

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...

CVE-2026-108549

The software cc-connect through version 1.5.0 is vulnerable to a missing authentication flaw in the MAX platform adapter webhook mode (specifically in platform/max/max.go). If no webhook_secret is configured, the application accepts unauthenticated updates. A remote attacker capable of reaching t...

CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhooksecret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an...

EUVD-2026-96342

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

CVE-2026-108165

Versions of Immich through 3.3.1 are vulnerable to a missing authorization flaw in the partner synchronization stream. The root cause is that synchronization queries fail to exclude Locked visibility, allowing authenticated partners to access Locked Folder asset metadata. An attacker with an acti...

EUVD-2026-96320

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

DejaVu-CVE-2021-22205

Ce depot n’a pas de fichier README...

CVE-2025-1639

🔓 سكربت استغلال لـ CVE-2025-1639 📝 الوصف إضافة Animation Addons for Elementor Pro لووردبريس معرضة لتثبيت إضافات غير مصرح بها بسبب نقص التحقق من الصلاحية في دالة installelementorpluginhandler في جميع الإصدارات حتى 1.6. هذا يتيح للمهاجمين الموثقين، بصلاحية المشترك فما فوق، تثبيت وتفعيل إضافات عشوائ...

CVE-2017-13208-Scanner

ماسح CVE-2017-13208 https://nvd.nist.gov/vuln/detail/CVE-2017-13208 مقدمة هذا سكريبت بسيط قادر على اكتشاف الثغرة CVE-2017-13208 في ملفات libnetutils.so الخاصة بأندرويد. كيفية عمله باستخدام r2pipe، يتحقق السكريبت مما إذا كانت قيمة dhcpsize قد تم فحصها، إذا لم تكن كذلك - يكون الملف عرضة للخطر. جميع...