https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 01:22:34 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-108615 <p>JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users&#39; AI evaluator or test-tracking records without owner or tenant checks.</p> <p>JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users&#39; AI evaluator or test-tracking records without owner or tenant checks.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-108615 https://vulnerability.circl.lu/vuln/ghsa-cvf2-rj3q-wqv8 <p>JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users&#39; AI evaluator or test-tracking records without owner or tenant checks.</p> <p>JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users&#39; AI evaluator or test-tracking records without owner or tenant checks.</p> https://vulnerability.circl.lu/vuln/ghsa-cvf2-rj3q-wqv8