| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes. |
| B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community. |
| Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-session UUID. An accepted emergency contact could submit the contact's own identifier, transition the victim's session from WAITING to READY, clear wait_till, retrieve recovery information, and continue account recovery before the owner-configured notice period expired. Exploitation of the approval bypass required the victim to have previously added and accepted the attacker as an emergency contact, and it did not create recovery rights for an arbitrary account. Separately, the same insufficiently scoped update pattern affected the reject and stop recovery transitions, allowing a user who knew another recovery-session UUID to potentially cancel a session to which the user was not a party. This issue is fixed in server image 2026.07.09. |
| abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call ChatAppService.GetListAsync or SendMessageAsync with a victim's ConversationId GUID to read chat messages and inject messages into that conversation. |
| ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks. |
| Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports. |
| In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing |
| The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account. |
| zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments. |
| MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books. |
| Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values. |
| Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes. |
| Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses. |
| LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects. |
| Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. |
| In the Linux kernel, the following vulnerability has been resolved:
scsi: sd_zbc: Reject disks with too many zones
sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and
stores the result in the unsigned int nr_zones field of struct
zoned_disk_info, silently truncating counts that exceed 32 bits. The
truncated count is later used to size per-zone resources, while the device
may still report more zones than fit.
Moreover, sd_zbc_report_zones() counts the reported zones with a signed int
zone_idx, which overflows past INT_MAX. Reject devices reporting more than
INT_MAX zones at scan time; such a device is not realistic for any medium
that exists today, and accepting it produces inconsistent zone bookkeeping. |
| In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix bpf_sock context code generation
Currently, the ctx access code reads the rx_queue_mapping
field with either a 4-byte or 2-byte load. The rest of the bits
in the register are marked known zero by the verifier. However,
the emitted ctx access code places in the register on certain
the special value (-1) using BPF_MOV_IMM64, which gets sign-extended
to turn on all the bits in the register. By shifting this value right,
the program ends up with a value at runtime above what the verifier
assumes is possible.
Fix this by ensuring the read value is as wide as the assumed size.
Use MOV32 instructions instead of MOV64 instructions to keep
the upper bits zero as assumed by the verifier. Also properly report
the size of the destination variable (the bpf_sock field, 4 bytes) instead
of the source (the socket field, 2 bytes). |
