CWE-285

The web interface offers a functionality to export the internal SQLite database. After executing the database export, an

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Con

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assi

NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/pages/forum/get_quotes.php` only

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior

SpiceDB is an open source database system for creating and managing security-critical application permissions. From vers

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "su

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instanc

Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalati

Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::a

A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an auth

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend d

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operati

Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.

Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.

Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19,

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Z

A vulnerability, which was classified as very critical, was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. T

XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" bi

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the reg

The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on t

The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stockt

The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and im

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS

The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Contr

Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specif

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper serv

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical

Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue

A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions

Azure Portal Elevation of Privilege Vulnerability