390 matches found
CVE-2026-105444
A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...
EUVD-2026-92801
A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...
CVE-2026-105444: Improper Control of Resource Identifiers
A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...
PT-2026-106230
Name of the Vulnerable Software and Affected Versions dotnet eShop version .NET 8 Description An issue exists in the Ordering API component within the GetOrderAsync function located in the src/Ordering.API/Apis/OrdersApi.cs file. A remote attacker can manipulate the OrderNumber argument to cause...
CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...
CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...
EUVD-2026-90651
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...
CVE-2026-103257 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...
CVE-2026-103257: Improper Limitation of a Pathname to a Restricted Directory
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...
PT-2026-103790
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...
EUVD-2026-88048
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...
CVE-2026-100884
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...
CVE-2026-100884: Improper Control of Resource Identifiers
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...
CVE-2026-95847: Improper Control of Resource Identifiers
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...
CVE-2026-94149 Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...
PT-2026-96051
Name of the Vulnerable Software and Affected Versions Omega Solution HRM OS versions prior to 20260717 Description An issue exists in the Role Permission Retrieval Endpoint within the /role-permission/permission file. Remote manipulation of the roleId argument allows for improper control of...
CVE-2026-94149: Improper Control of Resource Identifiers
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...
CVE-2026-3855: Improper Control of Resource Identifiers
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cau...
Astra Linux – Vulnerability in Twisted
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...
PT-2026-83290
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...