cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 109

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 8.5CVE-2026-103259EPSS 0.2%

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session…

  2. 8.1CVE-2026-103257EPSS 0.4%

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirec…

  3. 7.0CVE-2026-103254EPSS 0.3%

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint…

  4. 7.1CVE-2026-103252EPSS 0.3%

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. At…

  5. 7.5CVE-2026-103251EPSS 0.2%

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can…

  6. 5.8CVE-2026-103247EPSS 0.2%

    n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matchi…

  7. 8.3CVE-2026-103246EPSS 0.3%

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker…

  8. 7.2CVE-2026-103082EPSS 0.2%

    Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

  9. 6.1CVE-2026-83589EPSS 0.4%

    A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially …

  10. 7.1CVE-2026-64948EPSS 0.2%

    Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.

  11. 7.5CVE-2026-64947EPSS 0.3%

    A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards.

  12. 7.4CVE-2026-64946EPSS 0.2%

    A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 …

  13. 5.9CVE-2026-34190EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 o…

  14. 5.9CVE-2026-34189EPSS 0.2%

    Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards.

  15. 5.5CVE-2026-103497EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

  16. 5.4CVE-2026-103496EPSS 0.1%

    In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

  17. 4.3CVE-2026-103495EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

  18. 6.5CVE-2026-103491EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

  19. 7.2CVE-2026-103490EPSS 0.3%

    In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

  20. 7.1CVE-2026-103488EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

  21. 7.1CVE-2026-103659EPSS 0.2%

    MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level …

  22. 7.5CVE-2026-93882EPSS 0.4%

    The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items()…

  23. 6.8CVE-2026-78249EPSS 0.2%

    A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of ex…

  24. 9.3CVE-2025-41753EPSS 0.6%

    The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outs…

  25. 7.5CVE-2026-96255EPSS 0.3%

    The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attacke…

  26. 5.3CVE-2026-96200EPSS 0.2%

    The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without p…

  27. 5.3CVE-2026-96173EPSS 0.2%

    The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an …

  28. 6.5CVE-2026-90974EPSS 0.2%

    The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials…

  29. 5.4CVE-2026-90972EPSS 0.1%

    The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

  30. 4.3CVE-2026-88999EPSS 0.3%

    The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it poss…

  31. 8.8CVE-2026-80275EPSS 0.3%

    Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to ove…

  32. 2.1CVE-2026-103542EPSS 0.2%

    A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forger…

  33. 2.1CVE-2026-103541EPSS 0.2%

    A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It …

  34. 8.8CVE-2026-101147EPSS 0.1%

    The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted UR…

  35. 5.3CVE-2026-92548EPSS 0.3%

    The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive ed…

  36. 8.7CVE-2026-82828EPSS 0.2%

    Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0.

  37. 7.1CVE-2026-78210EPSS 0.3%

    In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.

  38. 5.9CVE-2026-76147EPSS 0.4%

    A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

  39. 7.3CVE-2026-76143EPSS 0.3%

    A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.

  40. 9.3CVE-2026-76142EPSS 0.3%

    Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

  41. 7.5CVE-2026-92245EPSS 0.4%

    The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to ex…

  42. 6.5CVE-2026-91109EPSS 0.3%

    The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. …

  43. 2.1CVE-2026-103534EPSS 0.3%

    A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper acc…

  44. 1.2CVE-2026-103533EPSS 0.3%

    A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API En…

  45. 6.9CVE-2026-103532EPSS 0.4%

    A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password…

  46. 6.9CVE-2026-103530EPSS 0.3%

    A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provider_options…

  47. 9.8CVE-2026-51869EPSS 0.4%

    DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.

  48. 9.8CVE-2026-51867EPSS 0.3%

    agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visi…

  49. 9.1CVE-2026-51864EPSS 0.9%

    DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the int…

  50. 9.1CVE-2026-51862EPSS 0.9%

    DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or …