MapTiler Tileserver-php v2.0 - Unauthenticated File Read

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests id: CVE-2025-44137 info: name: MapTiler Tileserver-php v2.0 -...

CVE-2026-89013

CVE-2026-89013 — Dolibarr hashp=shared 認可バイパス CVE-2026-89013 のエクスプロイト: document.php と viewimage.php は hashp パラメータが存在する場合に NOLOGIN を強制します。内部マーカー値 shared は 共有トークンの解決をスキップしますが、アクセス制御のオーバーライドは空でない値に対して 依然として発動し、$accessallowed = 1 を設定して dolchecksecureaccessdocument の結果を破棄します。したがって、未認証のリクエストで すべての...

CVE-2026-101063

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-9289

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

EUVD-2026-80211

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

GitLab 18.7 < 18.11.12 / 19.0 < 19.0.9 / 19.1 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-85706)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authenticatio...

CVE-2026-61590: Missing Authentication for Critical Function

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CVE-2026-90547 WWBN AVideo Missing Authorization via getBookmarks.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, allowing unauthenticated attackers to read chapter names from password-protected videos. Attackers can query the endpoint with a video ID...

EUVD-2026-76857

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

CVE-2026-90539 WWBN AVideo Missing Authentication via menuItems.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

PT-2026-88869

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-19858

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

SUSE CVE-2026-41327

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a...

EUVD-2026-69867

The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...

CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...

CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...

EEF-CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path

Summary Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which...

CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270

Erlang/OTP inets httpd contains an improper handling of case sensitivity flaw in mod_auth:secret_path/3 , which matches a request path against a configured protected directory using re:run/3 without the caseless option . On case-insensitive filesystems , a request for /secret/file against a direc...