By weakness (CWE)

CWE-863: related vulnerabilities

CVEs classified under CWE-863. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

110 published vulnerabilities · page 2 of 2

• CVE-2026-48776MEDIUM 4.2

  A path traversal vulnerability in LangGraph Python SDK versions 0.3.14 and earlier allows authenticated users to manipulate resource identifiers in HTTP requests, potentially accessing or modifying resources they shouldn't have permission to reach. The vulnerability stems from unsafe construction of URL paths using caller-supplied identifiers without proper sanitization. An attacker with valid credentials could craft specially formatted identifier values containing URL path characters to bypass authorization checks, particularly in deployments where access control relies on URL-prefix validation rather than application-level authorization.

• CVE-2026-53860MEDIUM 4.2

  OpenClaw versions before 2026.5.7 contain a flaw in the BlueBubbles feature that allows authenticated users to bypass sender identity verification. Instead of confirming the actual sender, the system can be tricked into matching allowlist rules based on conversation metadata—data that attackers can influence. This means an attacker with legitimate access could manipulate conversation identifiers to receive responses that should only go to authorized senders, effectively circumventing access controls meant to restrict agent functionality.

• CVE-2026-53809LOW 3.8

  OpenClaw versions prior to 2026.4.25 contain a policy bypass flaw that weakens access controls for bundled development tools. When an attacker has local access to a system running the embedded runner feature, they can use provider aliases (alternative names for tool repositories) to bypass intended restrictions on which tools they're allowed to use. The vulnerability is context-specific—it only affects configurations where this feature is explicitly enabled—but it does allow unauthorized tool selection outside policy boundaries.

• CVE-2026-8074LOW 3.8

  Mattermost has a permission enforcement gap in its user status management API. A User Manager with write access to user management—but explicitly without access to manage integrations or bots—can deactivate bot accounts by directly calling the user active status endpoint. This should not be possible; the API should reject such requests from users lacking bot management permissions. The vulnerability affects Mattermost Server versions 11.7.0 and earlier in the 11.7.x branch, and 10.11.17 and earlier in the 10.11.x branch.

• CVE-2026-8823LOW 3.8

  Mattermost has a permission validation flaw affecting versions 11.7.0 and 10.11.x up to 10.11.17. When an administrator with limited privileges attempts to demote a user to guest status, the system fails to properly verify whether the target is a bot account. This oversight allows a lower-privileged admin to degrade arbitrary bot accounts—including those managed by higher-privileged administrators—through the standard user demotion API. The impact is confined to integrity and availability concerns within the messaging platform.

• CVE-2026-41852LOW 3.7

  Spring Expression Language (SpEL) in VMware Spring Framework contains a flaw that allows attackers to invoke arbitrary methods with zero arguments even in contexts designed to restrict or prevent such actions. An attacker with network access could exploit this to trigger unintended application logic, potentially leading to denial of service or information disclosure depending on available methods and application design. This affects multiple versions across the 5.3, 6.1, 6.2, and 7.0 release branches.

• CVE-2026-3553LOW 3.1

  GitLab Community Edition and Enterprise Edition contain an authorization flaw that allows authenticated users to view confidential issue details they should not have access to. The vulnerability affects versions 12.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. An attacker must already have valid GitLab credentials to exploit it, and success depends on specific configuration or state conditions. While the exposure is limited to reading sensitive issue metadata rather than system compromise, it represents a meaningful confidentiality breach for organizations using affected versions.

• CVE-2026-45426LOW 3.1

  Apache Airflow's log server uses a flawed string-matching approach to authorize workers' access to task logs. Instead of checking if a worker's JWT token matches a specific Dag name exactly, the system strips characters from the left side of requested Dag names in a way that can match multiple unintended Dags. An authenticated worker with a token for 'dag_a' could read logs from 'dag_attacker', 'aaaa_target', or '_dag_secret'—any Dag whose name starts with characters found in 'dag_a'. This breaks the intended per-Dag log isolation in multi-team environments.

• CVE-2026-50266LOW 2.2

  A flaw in OpenStack Neutron versions before 28.0.1 allows project managers to perform network spoofing attacks on shared networks. The vulnerability stems from overly permissive role-based access control (RBAC) policies that allow any project manager to create or modify ports on networks they don't own, and crucially, to assign those ports special "trusted" network service identities (like DHCP servers). This bypasses normal anti-spoofing rules and security group protections, enabling attackers to spoof DHCP, MAC, or IP addresses to target other tenants sharing the same network. This is a reintroduction of a vulnerability that was supposedly fixed nearly a decade ago.

• CVE-2026-46549LOW 2.0

  NocoDB, a spreadsheet-like database platform, contained a flaw in how it handled OAuth token permissions. When administrators issued OAuth tokens with intentionally restricted scopes—such as limiting access to specific features or databases—the system failed to actually enforce those restrictions. A user with such a restricted token could gain access to resources and perform actions far beyond what the token was meant to allow, effectively inheriting the full permissions of the underlying user account. This issue has been patched in version 2026.04.1.