CVE-2026-100718 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...

CVE-2026-100719 Froxlor before 2.3.12 Credential Disclosure via DirProtections API

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

EUVD-2026-87684

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100710 Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...

EUVD-2026-87661

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

EUVD-2026-87659

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

EUVD-2026-87658

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retrieve sensitive chat identity linking data includin...

EUVD-2026-87650

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100654 vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

vLLM before 0.29.0 accepts user-controlled stoptokenids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When mintokens 0, the stop token ids a...

EUVD-2026-87740

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

EUVD-2026-87722

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply appid but omit orgid, limitedtoorgs, and expiresat resolve the target app and scope the key to it, but never add the app's...

EUVD-2026-87715

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikeymanager to rotate a higher-privileged orgsuperadmin sibling key and recover its plaintext credential. Attackers with apikeymanager role can enumerate same-owner API keys, rotate a strong...

EUVD-2026-87708

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

EUVD-2026-87700

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read cha...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

freevulnsearch

freevulnsearch This NMAP NSE script is part of the Free OCSAF project - https://freecybersecurity.org. In conjunction with the version scan "-sV" in NMAP, the corresponding vulnerabilities are automatically assigned using CVE Common Vulnerabilities and Exposures and the severity of the...