DB-GPT <= 0.8.1 - Arbitrary File Write

DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the userid HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON...

foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

foreman: authorization flaw in the Foreman::Controller::UserAware#find_user handling used by Api::V2::PersonalAccessTokensController

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

CVE-2026-86324

A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAwarefinduser using User.findparams:userid without enforcing the required parent-user authorization check. An attacker with the createsshkeys permission can exploit this...

CVE-2026-86322

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

EUVD-2026-124677

A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAwarefinduser using User.findparams:userid without enforcing the required parent-user authorization check. An attacker with the createsshkeys permission can exploit this...

CVE-2026-86324

A flaw in Foreman 's Api::V2::SshKeysController allows for an authorization bypass because the system resolves the target user via Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing required parent-user authorization checks. An attacker possessing the cre...

EUVD-2026-124676

A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mailnotifications endpoint resolves the target account using User.findparams:id without verifying that the...

CVE-2026-86322 Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

CVE-2026-86322

A flaw exists in Foreman 's Api::V2::PersonalAccessTokensController where Foreman::Controller::UserAware#find_user resolves accounts using User.find(params[:user_id]) without a required parent-user authorization check. An attacker possessing the create_personal_access_tokens permission can exploi...

EUVD-2026-124675

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

PT-2026-146048

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefind user resolves the target account using User.findparams:user id without applying the required parent-user authorization check. An attacker with the create personal access tokens permissi...

CVE-2026-86322: Red Hat: A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user…

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

CVE-2026-123506

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projectswebhooks to manage the owner's user-level webhooks by supplying userid in request bodies. Attackers can register user webhooks to their own receiver to obtain...

CVE-2026-123506 Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projectswebhooks to manage the owner's user-level webhooks by supplying userid in request bodies. Attackers can register user webhooks to their own receiver to obtain...

EUVD-2026-119391

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projectswebhooks to manage the owner's user-level webhooks by supplying userid in request bodies. Attackers can register user webhooks to their own receiver to obtain...

CVE-2026-123506

The software Vikunja (versions 2.2.0 before 2.7.1) contains an authorization bypass vulnerability involving project webhook endpoints. The root cause allows users with tokens scoped only to projects_webhooks to manage an owner's user-level webhooks by supplying a user_id in request bodies. This e...

CVE-2026-123506 Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projectswebhooks to manage the owner's user-level webhooks by supplying userid in request bodies. Attackers can register user webhooks to their own receiver to obtain...