Total
1688 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-15197 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user. | |||||
| CVE-2017-15208 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user. | |||||
| CVE-2017-15199 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description. | |||||
| CVE-2017-15211 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user. | |||||
| CVE-2017-15206 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user. | |||||
| CVE-2017-15204 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user. | |||||
| CVE-2017-15203 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user. | |||||
| CVE-2017-15209 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user. | |||||
| CVE-2017-15207 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user. | |||||
| CVE-2017-15195 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user. | |||||
| CVE-2017-15200 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user. | |||||
| CVE-2017-15201 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user. | |||||
| CVE-2017-15202 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user. | |||||
| CVE-2017-15196 | 1 Kanboard | 1 Kanboard | 2026-05-13 | 4.0 MEDIUM | 4.3 MEDIUM |
| In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user. | |||||
| CVE-2026-40981 | 1 Vmware | 1 Spring Cloud Config | 2026-05-12 | N/A | 7.5 HIGH |
| When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater. | |||||
| CVE-2026-6355 | 1 Augmentt | 1 Augmentt | 2026-05-12 | N/A | 6.5 MEDIUM |
| A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct object references. This could lead to unauthorized access to sensitive information and unauthorized changes to the tenant's configuration. | |||||
| CVE-2026-42205 | 2026-05-12 | N/A | 8.8 HIGH | ||
| Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2. | |||||
| CVE-2026-43883 | 2026-05-12 | N/A | 4.2 MEDIUM | ||
| WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim. Commit 0da3dcff1eda2f497694bf82b559829471c292c2 contains an updated fix. | |||||
| CVE-2026-6001 | 2026-05-12 | N/A | 8.8 HIGH | ||
| Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers. This issue affects BAPSİS: before v.202604152042. | |||||
| CVE-2026-41950 | 1 Langgenius | 1 Dify | 2026-05-12 | N/A | 6.5 MEDIUM |
| Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the files array of a chat-messages request. Attackers can exploit insufficient permission verification in the chat-messages endpoints to access files without ownership validation, bypassing workspace separation and signed URL protections to retrieve sensitive file contents through workflow processing. | |||||