Veille CVE

Vendredi 16 octobre 2026

1 CVE

Critique 0 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « JeecgBoot » ✕
  1. CVE-2026-108674 4.3 Moyenne

    JeecgBoot

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.