SEC.co
Emergency

By weakness (CWE)

CWE-284: related vulnerabilities

CVEs classified under CWE-284. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

304 published vulnerabilities · page 4 of 4

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-11464LOW 3.1

    JeecgBoot versions up to 3.9.2 contain a vulnerability in the User List Endpoint that allows authenticated users to disclose sensitive information by manipulating a salt parameter. An attacker with valid credentials can exploit this flaw to access restricted data, though doing so requires specific conditions and technical knowledge. A fix is planned for a future release.

  • CVE-2026-28378LOW 3.1

    A Grafana vulnerability allows an administrator in one organization to delete public dashboards belonging to a different organization. The issue stems from insufficient access controls on the dashboard deletion endpoint, which does not properly verify organizational boundaries. An authenticated org admin can exploit this by crafting requests with another organization's dashboard identifiers to remove their dashboards without authorization.

  • CVE-2026-45154LOW 2.6

    Nextcloud, an open-source content collaboration platform, contains a flaw affecting versions 2.6.0 through 4.2.x that allows guest users to retrieve deleted collaborative pages from the trash when the parent collective is shared in view-only mode. An attacker with guest access could circumvent intended deletion by directly accessing removed content, though the exposure is limited to information disclosure and requires prior access to the shared collective. The vulnerability has been resolved in version 4.3.0.

  • CVE-2026-48617LOW 1.8

    Node.js versions 22, 24, and 26 contain a flaw in how they enforce the Permission Model security feature. Specifically, the `process.report.writeReport()` function does not properly validate file paths, allowing an authenticated local attacker with high privileges to bypass the intended security boundary. The risk is limited to integrity impact in this case, though the vulnerability could expose sensitive information under certain configurations. This is a low-severity issue that requires local access and user interaction to exploit.