CVE-2026-19903 | Medium | 5.3 | 2026-08-15 | A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Data… |
CVE-2026-60011 | Medium | 5.3 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product. |
CVE-2026-21760 | Medium | 4.6 | 2026-07-17 | HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthori… |
CVE-2024-23573 | Low | 3.7 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and… |
CVE-2026-13533 | Medium | 5.3 | 2026-06-29 | A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/conf… |
CVE-2026-10521 | High | 7.2 | 2026-06-23 | An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters… |
CVE-2026-9610 | Low | 2.3 | 2026-06-22 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is acc… |
CVE-2026-34028 | | | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An… |
CVE-2026-11986 | Medium | 4.9 | 2026-06-11 | A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certai… |
CVE-2026-8205 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which r… |
CVE-2026-42297 | High | 8.3 | 2026-05-09 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, th… |
CVE-2026-7500 | Medium | 5.4 | 2026-04-30 | When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned pa… |
CVE-2024-58343 | Medium | 4.3 | 2026-04-16 | Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id. |
CVE-2026-35029 | High | 8.8 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role… |
CVE-2026-29909 | Medium | 5.3 | 2026-03-30 | MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authenticati… |
CVE-2025-15381 | High | 7.1 | 2026-03-27 | In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This… |
CVE-2026-4900 | Medium | 5.3 | 2026-03-26 | A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulat… |
CVE-2026-34056 | High | 7.7 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to… |
CVE-2026-34051 | Medium | 5.4 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access cont… |
CVE-2026-33217 | High | 7.1 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on messag… |
CVE-2026-4532 | Medium | 5.3 | 2026-03-22 | A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-22732 | Critical | 9.1 | 2026-03-19 | When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be writ… |
CVE-2026-32867 | Medium | 5.4 | 2026-03-19 | OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/… |
CVE-2025-15587 | | | 2026-03-16 | Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessin… |
CVE-2026-25679 | High | 7.5 | 2026-03-06 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. |
CVE-2026-1978 | Medium | 5.3 | 2026-02-06 | A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the compone… |
CVE-2025-52024 | Critical | 9.4 | 2026-01-23 | A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By ac… |
CVE-2026-0790 | High | 7.5 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive informa… |
CVE-2026-0650 | | | 2026-01-07 | OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normal… |
CVE-2025-15153 | Low | 3.7 | 2025-12-28 | A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Execut… |
CVE-2025-67844 | Medium | 5.0 | 2025-12-19 | The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and… |
CVE-2025-65011 | | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in que… |
CVE-2025-26381 | | | 2025-12-17 | Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information. |
CVE-2025-14697 | Low | 3.7 | 2025-12-15 | A security flaw has been discovered in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this issue is some unknow… |
CVE-2025-57823 | Low | 2.7 | 2025-12-09 | A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator… |
CVE-2025-6195 | Medium | 4.3 | 2025-11-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed… |
CVE-2025-62778 | Medium | 5.3 | 2025-10-27 | Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the… |
CVE-2025-11280 | Low | 3.7 | 2025-10-05 | A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation… |
CVE-2025-59797 | Medium | 5.8 | 2025-09-22 | Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management p… |
CVE-2025-10287 | Low | 3.1 | 2025-09-12 | A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown function of the file /au… |
CVE-2025-31971 | Medium | 5.1 | 2025-08-28 | AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery (SSRF) attack… |
CVE-2022-43110 | Critical | 9.8 | 2025-08-22 | Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web… |
CVE-2025-55736 | Medium | 6.5 | 2025-08-19 | flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete u… |
CVE-2025-41404 | Medium | 4.3 | 2025-06-26 | Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-public contents may be vi… |
CVE-2025-53073 | Medium | 4.2 | 2025-06-24 | In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) wi… |
CVE-2025-52920 | Medium | 6.4 | 2025-06-23 | Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and eas… |
CVE-2025-6352 | Medium | 5.3 | 2025-06-20 | A vulnerability classified as problematic has been found in code-projects Automated Voting System 1.0. Affected is an unknown function of the file /vote.php of… |
CVE-2025-48207 | High | 8.6 | 2025-05-21 | The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48205 | High | 8.6 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48202 | Medium | 5.3 | 2025-05-21 | The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48201 | High | 8.6 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. |
CVE-2025-47226 | Medium | 5.0 | 2025-05-02 | Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information. |
CVE-2025-46690 | Medium | 5.0 | 2025-04-27 | Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request. |
CVE-2025-27581 | Medium | 4.3 | 2025-04-24 | NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct req… |
CVE-2025-2595 | Medium | 5.3 | 2025-04-23 | An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of… |
CVE-2025-32367 | High | 8.6 | 2025-04-11 | The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the numbe… |
CVE-2025-26689 | Critical | 9.8 | 2025-03-31 | Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request… |
CVE-2025-1542 | | | 2025-03-26 | Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain… |
CVE-2025-2147 | Medium | 5.3 | 2025-03-10 | A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as prob… |
CVE-2024-55075 | Medium | 4.3 | 2025-01-06 | Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and rec… |
CVE-2024-9945 | Medium | 5.3 | 2024-12-13 | An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in ce… |
CVE-2024-11049 | Low | 3.7 | 2024-11-10 | A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1. Affected is an unknown function of the file /auth_files/photo/ of the comp… |
CVE-2024-45195 | High | 7.5 | 2024-09-04 | Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to versi… |
CVE-2024-7753 | Medium | 5.3 | 2024-08-14 | A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code… |
CVE-2024-42001 | High | 8.6 | 2024-08-12 | An improper authentication vulnerability affecting Vonets
industrial wifi bridge relays and wifi bridge repeaters, software versions
3.3.23.6.9 and p… |
CVE-2024-33897 | Critical | 9.1 | 2024-08-06 | A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability iss… |
CVE-2024-7153 | Medium | 5.3 | 2024-07-27 | A vulnerability classified as problematic has been found in Netgear WN604 up to 20240719. Affected is an unknown function of the file siteSurvey.php. The manip… |
CVE-2024-7080 | Medium | 5.3 | 2024-07-24 | A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown… |
CVE-2024-39868 | High | 7.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe… |
CVE-2024-39867 | High | 7.6 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication whe… |
CVE-2024-6414 | Medium | 5.3 | 2024-06-30 | A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage… |
CVE-2024-6188 | Medium | 5.3 | 2024-06-20 | A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export… |
CVE-2024-2730 | Medium | 5.3 | 2024-04-10 | Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which coul… |
CVE-2023-45598 | Medium | 5.3 | 2024-03-05 | A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allows a remote unauthenticated attacker to… |
CVE-2023-45596 | Medium | 5.3 | 2024-03-05 | A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web application allows a remote unauthenticated a… |
CVE-2024-0861 | Medium | 4.3 | 2024-02-22 | An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2023-46186 | Medium | 5.3 | 2024-02-14 | IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access con… |
CVE-2024-24592 | Critical | 9.8 | 2024-02-06 | Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, mod… |
CVE-2023-50935 | Medium | 6.5 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to applic… |
CVE-2024-0456 | Medium | 4.3 | 2024-01-26 | An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able… |
CVE-2024-0204 | Critical | 9.8 | 2024-01-22 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. |
CVE-2023-44320 | Medium | 4.3 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-5786 | Medium | 5.3 | 2023-10-26 | A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geos… |
CVE-2023-5702 | Medium | 4.3 | 2023-10-23 | A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2023-45809 | Low | 2.7 | 2023-10-19 | Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct UR… |
CVE-2023-4018 | Medium | 4.3 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper… |
CVE-2023-4544 | Medium | 4.3 | 2023-08-26 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230809. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2023-3426 | Medium | 4.3 | 2023-08-02 | The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows re… |
CVE-2023-3792 | Medium | 4.3 | 2023-07-20 | A vulnerability was found in Beijing Netcon NS-ASG 6.3. It has been classified as problematic. This affects an unknown part of the file /admin/test_status.php… |
CVE-2015-1313 | Medium | 6.5 | 2023-06-29 | JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced b… |
CVE-2023-22834 | Low | 2.7 | 2023-06-27 | The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass fo… |
CVE-2023-28160 | Medium | 6.5 | 2023-06-02 | When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive… |
CVE-2023-2524 | Medium | 6.3 | 2023-05-04 | A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to… |
CVE-2023-1699 | Medium | 4.3 | 2023-03-30 | Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully… |
CVE-2023-1663 | Medium | 6.5 | 2023-03-29 | Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vul… |
CVE-2023-1682 | Medium | 4.3 | 2023-03-29 | A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui… |
CVE-2022-42438 | High | 7.5 | 2023-02-08 | IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM… |
CVE-2022-47700 | High | 7.5 | 2023-01-31 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Imprope… |
CVE-2022-4057 | Medium | 5.3 | 2023-01-02 | The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs. |
CVE-2022-42953 | High | 7.5 | 2022-12-25 | Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 an… |