By weakness (CWE)
CWE-285: related vulnerabilities
CVEs classified under CWE-285. Understanding the weakness class helps prioritize systemic fixes over one-off patches.
107 published vulnerabilities · page 2 of 2
- CVE-2026-13490LOW 3.7
A vulnerability in GLPI (Groupe Linux des Professionnels Informatiques), a popular open-source IT asset and helpdesk management system, allows an attacker to bypass authorization controls when viewing document files. By manipulating the document ID parameter in the document retrieval function, an unauthenticated attacker can potentially access files they should not be permitted to view. The issue affects versions 11.0.5, 11.0.6, and 11.0.7. While the attack is difficult to execute and requires specific conditions, it could expose sensitive documentation stored within GLPI instances.
- CVE-2026-13511LOW 3.1
VoltAgent versions up to 2.1.17 contain an authorization bypass vulnerability in the Memory REST API. An authenticated attacker can manipulate the conversationId parameter to access memory records they should not have permission to view. The vulnerability requires an existing login and is difficult to exploit in practice, but proof-of-concept code has been released publicly. A patch is under review by the maintainers.
- CVE-2026-40963LOW 3.1
Apache Airflow's UI structure_data endpoint was leaking metadata about linked workflows (DAGs) to users who shouldn't see them. An authenticated user with permission to view one workflow could discover the names and dependency relationships of other workflows they weren't authorized to access. This is a read-only information disclosure—no data modification or system disruption occurs—but it can undermine team isolation in multi-tenant Airflow deployments where workflow topology is considered sensitive.
- CVE-2026-59226LOW 3.1
Open WebUI versions 0.9.0 through 0.9.x contain a privilege and access control flaw where deactivated users can still trigger scheduled automation tasks and access AI models they should no longer have permission to use. The vulnerability stems from insufficient re-validation when executing stored automations and overly lenient model access checks. An attacker with a deactivated account could potentially continue running automations or accessing restricted models until the account is fully removed from the system.
- CVE-2026-13514LOW 2.4
Chess Play and Learn App for Android (versions up to 4.9.42) contains a security flaw in how it handles backup files specified in its AndroidManifest.xml configuration. An attacker with physical access to a device can potentially expose sensitive backup data that should remain protected. While the flaw is real and a proof-of-concept has been publicly disclosed, exploitation requires direct hands-on access to the device itself, which significantly limits the attack surface in most enterprise and personal use scenarios.
- CVE-2026-47713LOW 2.0
AnythingLLM versions before 1.13.0 contain a token persistence flaw that can leak sensitive data when administrators migrate from single-user to multi-user mode. A mobile device token issued in single-user mode may remain valid after the migration, allowing it to bypass user-scoping controls and access workspaces and chat content belonging to other users. The vulnerability requires an attacker to have had a legitimate mobile device token before the migration, then exploit it post-migration in the multi-user environment.
- CVE-2026-12065LOW 1.8
A vulnerability in the Groww Stock, Mutual Fund, and Gold app (Android versions up to 20260805) allows attackers with physical access to a device to bypass authorization checks on custom URL schemes handled by the app's WebView component. An attacker would need to be present at the device and have some level of authentication context, making this a low-risk issue in typical operational environments. The issue affects the app's custom protocol handlers, which are entry points for inter-app communication on Android.