CVE-2025-41764 Unchecked role in wwwupdate.cgi

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates...

CVE-2025-41764

CVE-2025-41764 : The connected documents confirm a vulnerability in the wwwupdate.cgi endpoint where insufficient authorization enforcement allows an unauthorized remote attacker to upload and apply arbitrary updates. CVSS‑3.1 metrics indicate a 9.1 (CRITICAL) base score, with Network attack vect...

CVE-2025-41762

CVE-2025-41762 describes an unauthenticated attacker exploiting a weak hash in the backup generated by the wwwdnload.cgi endpoint to gain access to sensitive data (e.g., password hashes and certificates). The described attack vector is local, with no user interaction required and no privileges re...

PT-2026-24033

A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files...

PT-2026-24035

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-41765 Description Insufficient authorization enforcement allows a remote attacker to upload and apply arbitrary data through the wwwupload.cgi endpoint. This includes contact images, HTTPS certificates, system backups,...

PT-2026-24118

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.31.5 Description Budibase is a low code platform used for creating internal tools, workflows, and admin panels. A flaw exists in the server's authorized middleware, which is designed to protect server-side API...

Apache IoTDB 安全漏洞

Apache IoTDB is an integrated data management engine designed for time-series data by the Apache Foundation in the United States. It provides services for data collection, storage, and analysis. Versions of Apache IoTDB from 1.0.0 to 1.3.7, as well as from 2.0.0 to 2.0.7, have security...

CVE-2026-3724

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. This impacts an unknown function of the file /checkin.php. This manipulation of the argument patientid causes improper authorization. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-20748

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

CVE-2026-26051

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

CVE-2026-20882

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

nab_script_exploit

No d...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the PUT /api/users/username API endpoint. An attacker can gain unauthorized elevated privileges by updating a user account to assign the super-admin role without proper validation. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the AuthorizeHost middleware due to incorrect validation of host JWT tokens. An attacker can gain unauthorized access to, modify, or delete resources belonging to other hosts by crafting requests that include ...

Missing Authorization

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Missing Authorization in the GET /files/:appId/metadata/:filename endpoint due to the lack of enforcement of beforeFind and...

CVE-2026-30850

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint GET /files/:appId/metadata/:filename does not enforce beforeFind / afterFind file triggers. When these triggers are used as...

CVE-2026-30857 WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypass in the knowledge base copy endpoint allows any authenticated user to clone duplicate another tenant’s knowledge base into their own tena...

CVE-2026-30857

Public technical details for CVE-2026-30857 are not provided in the connected documents. The included SUSE/PTSecurity entries describe unrelated issues; no WeKnora product, version, or remediation data is present here.

CVE-2026-30857 WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypass in the knowledge base copy endpoint allows any authenticated user to clone duplicate another tenant’s knowledge base into their own tena...

CVE-2026-30857 WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypass in the knowledge base copy endpoint allows any authenticated user to clone duplicate another tenant’s knowledge base into their own tena...