| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-108158 | 6.5 | plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office do | 2026-10-13 02:16:56 | 2026-10-09 17:16:46 |
| CVE-2026-108112 | 5.4 | ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them | 2026-10-13 02:16:56 | 2026-10-09 16:17:26 |
| CVE-2026-108111 | 4.3 | ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filter | 2026-10-13 02:16:56 | 2026-10-09 16:17:26 |
| CVE-2026-108110 | 6.8 | MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path | 2026-10-13 02:16:56 | 2026-10-09 16:17:26 |
| CVE-2026-100755 | 4.6 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page co | 2026-10-13 02:16:55 | 2026-10-13 02:16:55 |
| CVE-2026-100104 | 3.5 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery | 2026-10-13 02:16:54 | 2026-10-13 02:16:54 |
| CVE-2026-89124 | 4.3 | Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended author | 2026-10-13 01:16:49 | 2026-10-13 01:16:49 |
| CVE-2026-89122 | 6.1 | SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted applicat | 2026-10-13 01:16:49 | 2026-10-13 01:16:49 |
| CVE-2026-89121 | 4.7 | SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to mo | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89120 | 7.1 | A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: