37 matches found
EUVD-2026-97041
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...
CVE-2026-108867
JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SystemApiController within the getUserRoleSetById handler. This vulnerability allows any authenticated user to access and read the role assignments of other users by supplying an arbitrary userId parameter. Con...
CVE-2026-108867: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...
PT-2026-110189
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...
CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...
PT-2026-109910
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can read the role codes of any user due to missing authorization in the queryUserRolesById handler of the SystemApiController. Low-privileged attackers can exploit this by sendi...
BIT-MONGODB-2026-9754 Stack memory disclosure in filemd5 command
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
CVE-2026-9754
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
UBUNTU-CVE-2026-9754
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
CVE-2026-9754 Stack memory disclosure in filemd5 command
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
CVE-2026-9754
CVE-2026-9754 describes an issue where an authenticated user with the read role can read limited amounts of uninitialized stack memory via specially crafted issuances of the filemd5 command. The condition relies on issuing filemd5 in a crafted way to disclose memory that was not initialized, with...
CVE-2026-9754
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
Stack memory disclosure in filemd5 command
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
PT-2026-48304
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with the read role can read limited amounts of uninitialized stack memory. This occurs through specially-crafted issuances of the 'filemd5'...
CVE-2026-9754: Use of Uninitialized Variable
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
BIT-MONGODB-2026-4148 ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline...
PT-2026-32437
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline...
CVE-2026-4148
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline...