43 matches found
PT-2026-79878
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...
PT-2026-79937
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...
CVE-2026-58336
A flaw was found in Moodle. This vulnerability, an Insecure Direct Object Reference IDOR, allows an authenticated user with comment deletion permissions to delete comments they are not authorized to remove. This means a user could potentially delete any comment on the platform, leading to...
CVE-2026-47657
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...
CVE-2025-68640: Improper Authentication
The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...
EUVD-2026-5366
Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal...
CVE-2026-25161
CVE-2026-25161 affects Alist up to version 3.56.x, with a path traversal flaw in multiple file operation handlers. By injecting traversal sequences into filename components, an authenticated user can bypass directory-level authorisation and perform unauthorised removal, movement, or copying of fi...
CVE-2026-25161 Alist vulnerable to Path Traversal in multiple file operation handlers
Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains path traversal vulnerability in multiple file operation handlers. An authenticated attacker can bypass directory-level authorisation by injecting traversal...
EUVD-2023-43666
Malicious code in bioql PyPI...
UBUNTU-CVE-2025-53112
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.1...
CVE-2025-53112 GLPI's incomprehensive permission checks can lead to data removal from allowed users
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.1...
CVE-2025-53112
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.1...
CVE-2025-53112: Improper Access Control
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.1...
PT-2025-31388
Name of the Vulnerable Software and Affected Versions GLPI versions 9.1.0 through 10.0.18 Description GLPI is an Asset and IT Management Software package providing ITIL Service Desk features, licenses tracking, and software auditing. A lack of permission checks in affected versions can result in...
CVE-2025-27538
Summary: CVE-2025-27538 affects Mattermost Server versions 10.5.x (≤ 10.5.1) and 9.11.x (≤ 9.11.9). The issue is that MFA checks are not enforced in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user, enabling users with the edit_other_users permission to activate...
CVE-2023-23715 WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability
Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.2...
PT-2024-27472
Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 25.0.7 and prior to 26.0.2 Nextcloud Enterprise Server versions prior to 25.0.7 and prior to 26.0.2 Description Nextcloud Photos is a photo management app where users can remove photos from the album of...
PT-2024-3903
Name of the Vulnerable Software and Affected Versions: OpenObserve versions prior to 0.8.0 Description: A critical issue has been identified in the "/api/org id/users/email id" endpoint, allowing any authenticated user within an organization to remove any other user, including those with "Admin"...
WordPress Plugin WP Hotel Booking Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...