CWE-269

Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engin

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive p

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applic

In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to versi

An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client valid

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package).

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations). Suppo

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper val

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to versi

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to versi

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/projec

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to

Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who h

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that thi

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Suppor

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which c

Improper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had co

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package).

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow co

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported vers

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported ve

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apac

The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a

The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and in

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the L

authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PAT

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all pla

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any aut

In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission reso

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their sess

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted d

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a wo

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an aut

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an aut

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Cor

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registrat