CVE-2024-34644

Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interaction is required for triggering this vulnerability...

CVE-2024-34610

Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data...

CVE-2024-34643

Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interaction is required for triggering this vulnerability...

CVE-2025-23875

Cross-Site Request Forgery CSRF vulnerability in madeglobal Better Protected Pages better-protected-pages allows Stored XSS.This issue affects Better Protected Pages: from n/a through = 1.0...

CVE-2022-31112

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client respons...

CVE-2026-0650

OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API endpoints without valid credentials...

CVE-2024-39589

Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLCv3 16bf8bac1a36d95b73e7b8722d0edb8b9c5bb56a. A specially crafted EtherNet/IP request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to...

CVE-2025-46297: Improper Access Control

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected files within an App Sandbox container...

UniFi Network Authentication Bypass

The vulnerability of the UniFi Network software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Grafana Databricks Data Source Plugin Information Disclosure

The vulnerability of the data source plugin for open-source platforms for monitoring and observation by Grafana Databricks is related to insufficient spatial partitioning. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

SIMATIC CN 4100 Information Disclosure

The vulnerability of the MICROprogramming software for the SIMATIC CN 4100 communication gateway relates to the exposure of information. Exploiting this vulnerability can allow unauthorized individuals to gain unauthorized access to protected information...

ENENSYS IPGuard V2 Hardcoded Credentials Disclosure

The vulnerability of the ENENSYS IPGuard V2 device for switching transport levels is related to the use of strictly encrypted account data. Exploiting this vulnerability could allow a remote attacker to disclose the protected information...

Cisco Identity Services Engine Disclosure

The vulnerability of the Cisco Identity Services Engine ISE web interface is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

GNU Mailman Restricted Access Bypass Info Disclosure

The vulnerability of the GNU Mailman email distribution management package relates to the possibility of bypassing a restricted-access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose protected information...

dify.ai parseInt() Data Compromise

The vulnerability of the parseInt function on the dify.ai development platform is related to the insufficient isolation of system-dependent functions. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected informatio...

tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE

A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If...

CVE-2026-21695 Titra API Contains Mass Assignment Vulnerability

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint use...

CVE-2026-21695 Titra API Contains Mass Assignment Vulnerability

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint use...

CVE-2025-31962 HCL BigFix IVR is impacted by an insufficient session expiration vulnerability

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods...

CVE-2025-31962

CVE-2025-31962 affects HCL BigFix IVR 4.2 Web UI authentication component. The root cause is insufficient session expiration, enabling an authenticated attacker to maintain prolonged access to protected API endpoints due to overly long session lifetimes. Documented impact is unauthorized access t...