CWE-863

A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file

Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document c

Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized servic

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Vent

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized acces

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, the

Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to en

The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-ac

Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public res

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system a

This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: fro

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with phys

An authentication issue was addressed with improved state management. This issue is fixed in watchOS 26.1. An attacker w

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Secu

In Malwarebytes Binisoft Windows Firewall Control before 6.16.0.0, the installer is vulnerable to local privilege escala

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonom

Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: fro

Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content

An access control issue in the component websURLFilterAddDel of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenti

In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Co

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Co

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure per

Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during s

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to perfo

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption

SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deplo

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect A

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect A

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect A

Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect A

Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow user

app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.

Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to res

Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior t

Umbraco is a free and open source .NET content management system. An improper API access control issue has been identifi