CWE-863

SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Docum

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy s

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-ma

OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mu

OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows l

Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configur

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with frien

OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in t

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the o

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Access

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privile

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restri

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could s

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could s

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-u

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTa

Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over

The Awesome Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to incorrect autho

The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. T

The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to sus

Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: f

The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access o

A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0,

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the publi

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorre

Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privile

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerabi

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a restrict

OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-messa

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authori

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users t

OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper

Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icon

n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without

Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects

Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint,

An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization by

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-r

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (c

OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks

Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated at

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a