6055 matches found
CVE-2026-108110
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...
CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...
CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...
CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...
CLSA-2026-1791537402 llvm: Fix of CVE-2024-7883
CVE-2024-7883: emit a vmov before the VLSTM in CMSE secure-to-non-secure calls that return a floating-point value, so CONTROLS.SFPA is set for both the VLSTM and the VLLDM and the lazy save area cannot be left uninitialised...
EUVD-2026-95349
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...
PT-2026-141133
Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev102 Description An authenticated non-admin user with the SETTINGS permission can perform a Server-Side Request Forgery SSRF attack. By accessing the /json/save config endpoint, an attacker can configure the...
CVE-2026-108110: Authorization Bypass Through User-Controlled Key
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...
PT-2026-108958
Name of the Vulnerable Software and Affected Versions MOVO versions prior to 0.2.4 Description An authorization bypass exists in the chat-api document endpoints. Authenticated users can access stored objects belonging to other users by providing arbitrary object paths. By sending a known target...
CVE-2026-107792
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...
CVE-2026-107792 Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...
CVE-2026-107792 Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...
CVE-2026-107792
The Jivejdon software (from commit d58a36b0 through ee67a65e ) is vulnerable to a missing authorization flaw within the UpdateThreadToForumAction component. This vulnerability allows authenticated users to relocate reply-less threads to arbitrary forums by sending crafted threadId and forumId val...
CVE-2026-107792 Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...
Himovo MOVO authorization issue vulnerability
The Himovo MOVO versions 0.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass in the chat-api documentation endpoints. It allows authenticated users to access objects stored by other users by providing arbitrary object paths. Attackers...
PT-2026-108254
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...
CVE-2026-107792: Missing Authorization
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...
CVE-2026-107175
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...
CVE-2026-107175
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...