DRUPAL-CONTRIB-2025-064

This module provides a block to easily display a rendered node. The module doesn't check access to content before displaying it to a visitor, allowing unauthorized users to retrieve a list of labels of all nodes...

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064

This module provides a block to easily display a rendered node. The module doesn't check access to content before displaying it to a visitor, allowing unauthorized users to retrieve a list of labels of all nodes...

CVE-2025-47937

CVE-2025-47937 affects TYPO3 (PHP-based CMS). The issue arises in TYPO3 versions 9.0.0 through just before the fixed ELTS releases, where a DBAL multi-table query applies FrontendGroupRestriction only to the first table. This can allow data from additional tables in the same query to be exposed t...

CVE-2025-3761

The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mtsaveprofile function not appropriately restricting access to unauthorized users to update roles. This makes it possible for...

Apache Pinot 安全漏洞

Apache Pinot is a real-time distributed OLAP data store from the Apache USA Foundation. It is designed to provide ultra-low latency analytics. A security vulnerability exists in Apache Pinot versions prior to 1.3 that stems from an authentication bypass issue that allows unauthorized users to add...

CVE-2024-2292

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users...

CVE-2024-44314

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...

CVE-2024-9000

In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...

CVE-2024-2292

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users...

CVE-2024-11300

CVE-2024-11300 affects lunary-ai/lunary prior to version 1.6.3, via improper access control that lets a user view another user’s prompt data. The issue is triggered by accessing specific URLs (notably /prompts/prompt_id) and impacts 1.6.2 and the main branch. Documented characteristics: unauthori...

CVE-2024-2292

CVE-2024-2292 describes an access-control flaw that lets unauthorized users view and modify other users’ data. The primary sources agree on lack of proper access control as the root cause, with the NVD/Red Hat and related entries confirming this as the issue. The CVSS score is 7.1 (HIGH) with net...

CVE-2024-10274

CVE-2024-10274 affects lunary-ai/lunary v1.5.5. The /users/me/org endpoint is improperly accessible due to insufficient access control, enabling unauthorized users to view sensitive organization member data (names, roles, emails). The issue is documented with CVSS v3.0 base score 6.5 (Confidentia...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

GHSA-W5H7-MW56-4V7X TastyIgniter Has an Incorrect Access Control Vulnerability

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...

CVE-2025-30111

On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access live video streams without proper authentication...

CVE-2025-30111

CVE-2025-30111 affects IROAD v9 dashcams. The issue arises from exposed endpoints that allow unauthorized users to list and download recorded videos and to access live video streams without proper authentication. Several sources (e.g., Red Hat advisory, NVD/NVD-linked entries, and CVE listings) d...

CVE-2024-44314

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...

org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

A flaw was found in Jetty's ThreadLimitHandler.getRemote. This flaw allows unauthorized users to cause remote denial of service DoS attacks. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform v2.X. The vulnerability stems from improper access control, which allows unauthorized users to access and operate the management endpoints...

CVE-2024-57055

Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain services without the necessary access level. This issue is limited to services used by the client not the general-use JSON services and requires reverse...