https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:30:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-268787 EUVD-2026-268787 https://cve.radiocsirt.org/vuln/euvd-2026-268787 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1436 <p>Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user&#39;s profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint &#39;http://&lt;IP&gt;:12900/users/&lt;my_user&gt;&#39; does not implement object-level authorization validations.</p> <p>Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user&#39;s profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint &#39;http://&lt;IP&gt;:12900/users/&lt;my_user&gt;&#39; does not implement object-level authorization validations.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-1436 https://cve.radiocsirt.org/vuln/ghsa-ff7j-jwgr-hgxp <p>Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user&#39;s profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint &#39;http://&lt;IP&gt;:12900/users/&lt;my_user&gt;&#39; does not implement object-level authorization validations.</p> <p>Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user&#39;s profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive third-party information to be accessed, such as names, email addresses, internal identifiers, and last activity. The endpoint &#39;http://&lt;IP&gt;:12900/users/&lt;my_user&gt;&#39; does not implement object-level authorization validations.</p> https://cve.radiocsirt.org/vuln/ghsa-ff7j-jwgr-hgxp https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0458 <p>Ein Angreifer kann mehrere Schwachstellen in Graylog ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Graylog ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0458