Base de CVEs

CVE-2026-41259 Alta · 7.5 CWE-841 23/04/2026

Mastodon: Insufficient verification of email addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.

CVE-2026-34582 Crítica · 9.1 CWE-841 07/04/2026

Botan has a TLS 1.3 certificate authentication bypass

Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records. This vulnerability is fixed in 3.11.1.

CVE-2026-30574 Alta · 7.5 CWE-841 27/03/2026

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management…

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if the requested sales quantity (txtqty) exceeds the available stock level. An attacker can manipulate the request to purchase a quantity that is significantly higher than the actual available stock.

CVE-2025-13459 Média · 4.9 CWE-841 16/03/2026

IBM Aspera Console Denial of Service

IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.

CVE-2026-3130 Crítica · 9.8 CWE-841 03/03/2026

Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier…

Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.

CVE-2025-52469 Alta · 7.1 CWE-841 02/03/2026

Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass

Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30.

CVE-2026-24774 Média · 4.3 CWE-841 03/02/2026

Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a business logic vulnerability allows authenticated students to improperly mark themselves as present in attendance activities, including activities that have already expired, by directly accessing a crafted URL. This issue has been patched in version 4.2.

CVE-2025-13129 Média · 4.3 CWE-841 01/12/2025

Business Logic Error in Seneka Software's Onaylarım

Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım allows Functionality Misuse. This issue affects Onaylarım: from 25.09.26.01 through 18112025.

CVE-2025-58051 Média · 6.5 CWE-841 16/10/2025

Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table

Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user. It is recommended that the Nextcloud Tables app is upgraded to 0.7.6, 0.8.8 or 0.9.5.

CVE-2025-55682 Média · 4.6 CWE-841 14/10/2025

Windows BitLocker Security Feature Bypass Vulnerability

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-55337 Média · 4.6 CWE-841 14/10/2025

Windows BitLocker Security Feature Bypass Vulnerability

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-55332 Média · 4.6 CWE-841 14/10/2025

Windows BitLocker Security Feature Bypass Vulnerability

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2025-55330 Média · 4.6 CWE-841 14/10/2025

Windows BitLocker Security Feature Bypass Vulnerability

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.