CVE-2026-87744Critical· 9.1▾ MidnightA flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without expli…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108938Medium· 5.3A flaw has been found in code-projects Matrimonial System 1.0
CVE-2026-78051Medium· 5.3A vulnerability was determined in alexta69 MeTube up to 2026.06.10
CVE-2025-11280Low· 3.7A flaw has been found in Frappe LMS 2.35.0
CVE-2025-62778Medium· 5.3Frappe Learning is a learning management system
CVE-2025-14697Low· 3.7A security flaw has been discovered in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3
CVE-2026-105046Medium· 4.3Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.