CWE-425
CVEs classified under CWE-425, newest first.
35 CVEsRSS
CVE-2026-106073Low· 3.3PoCnodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
A flaw was found in the Node.js Permission Model. fs.realpathSync() does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.nati…
CVE-2026-114135High· 8.8jupyter-server: jupyter-server: Unauthorized code execution via missing authorization check in gateway handler (CVE-2026-114135)
A flaw was found in jupyter-server. When configured with a gateway connection, the server validates user authentication but fails to verify whether the user has permission to run actions on computational kernels. A remote authenticated use…
CVE-2026-112144Medium· 5.3PoCsatya-vinay Events-Management-System project.sql file access
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories access…
CVE-2026-18662Medium· 6.9PoCIn Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. …
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. …
CVE-2026-102460High· 8.6In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as …
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as …
CVE-2026-15577Medium· 6.5A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization)
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available w…
CVE-2026-108938Medium· 5.3PoCA flaw has been found in code-projects Matrimonial System 1.0
A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The e…
CVE-2026-87744Critical· 9.1A flaw was found in Quarkus REST Data Panache
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without expli…
CVE-2026-105046Medium· 4.3Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
CVE-2026-80275High· 8.8Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to o…
CVE-2026-102584Medium· 4.3A flaw was found in Moodle
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify …
CVE-2026-102582Low· 2.2A flaw was found in Moodle
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Con…
CVE-2026-102583Low· 2.7A flaw was found in Moodle
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. Thi…
CVE-2026-61837Medium· 5.3PoC⚖ disputedRabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks…
CVE-2026-40532Medium· 6.5A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
CVE-2026-79993High· 7.5The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its paren…
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its paren…
CVE-2026-59739High· 7.5Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are…
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are…
CVE-2026-36453High· 7.4Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.
CVE-2026-84656Medium· 4.3A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.
CVE-2026-78051Medium· 5.3A vulnerability was determined in alexta69 MeTube up to 2026.06.10
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories…
CVE-2026-19903Medium· 5.3A vulnerability has been found in SourceCodester Online Clothing Store 1.0
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote…
CVE-2026-64676Medium· 5.7⚖ disputedKata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers
Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory managem…
CVE-2024-23573Low· 3.7HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13
HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL…
CVE-2026-13533Medium· 5.3A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2
A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or…
CVE-2026-11986Medium· 4.9A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when …
CVE-2026-7500Medium· 5.4When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled
When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write…
CVE-2025-15381High· 7.1In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the e…
CVE-2026-33217High· 7.1NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing M…
CVE-2026-25679High· 7.5url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVE-2026-0650Critical· 9.3PoCOpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and…