CVE-2026-104117

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

EUVD-2026-95885

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CVE-2026-108112

The ruoyi-ai software, versions 3.0.0 through 3.1.0 , is vulnerable to a missing authorization flaw (CWE-862). Authenticated users can delete workflows belonging to other users via the POST /workflow/del/{uuid} endpoint. The root cause is that the softDelete() function fails to invoke the Privile...

CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

EUVD-2026-95884

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

CVE-2026-108111

The software ruoyi-ai versions 3.0.0 through 3.1.0 is vulnerable to a missing authorization vulnerability in the GET /workflow/search endpoint. The root cause is a lack of owner or is_public filtering, allowing authenticated non-admin users to query and list enabled private workflows within the s...

CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

CVE-2026-33367 Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication...

CVE-2026-33367

The Red Lion Controls N-Tron 700 Series is vulnerable to a missing authentication flaw where SNMP can be used to perform administrative actions. Attackers can retrieve configuration files, modify user accounts or device settings, and initiate firmware or bootloader upgrades/downgrades without any...

EUVD-2026-95800

A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...

CVE-2026-104116 Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones

A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...

CVE-2026-104116

A missing authorization check in the illumos zones statistics daemon (zonestatd) allows an unprivileged local user in any zone to disrupt zonestat in other zones and enumerate running zones. The vulnerability resides in the zsd_server() procedure within usr/src/cmd/zonestat/zonestatd/zonestatd.c,...

CVE-2026-104116 Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones

A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...

CVE-2026-104117 Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

CVE-2026-104117

A missing authorization check in the illumos IP management daemon (ipmgmtd ) allows an unprivileged local user to modify the persistent IP multipathing (IPMP) configuration. Specifically, the door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c fails to require solaris.network.in...

CVE-2026-104117 Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

WordPress Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion vulnerability

Missing Authorization to Authenticated Custom+ Arbitrary Academy Comment Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Academy LMS versions = 4.0.3...