2026

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allow

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated user

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows aut

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authentic

REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows au

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users t

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController tha

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes t

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetc

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to sen

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to can

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to for

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-sco

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of Rm

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to acc

ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-s

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unau

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module Download

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows

Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend ad

PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buy

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to downloa

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows au

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privi

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the m

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allo

sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read acco

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files ou

Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL th

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke ex

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIMan

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to insta

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perfor

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-leve

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated atta