CVE-2026-77293

The collaborative travel planner TREK is vulnerable to an Insecure Direct Object Reference (IDOR) or Broken Access Control issue in versions prior to 3.3.0 . The DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint fails to properly verify if the target note-file belongs to the a...

CVE-2026-77320 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...

CVE-2026-77320

The collaborative travel planner TREK is vulnerable to an information disclosure flaw in versions prior to 3.3.0 . The getSharedTripData function in server/src/services/shareService.ts fails to respect the share_map permission on the server-side. Consequently, while the client UI may hide the map...

CVE-2026-77320 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...

CVE-2026-77320 TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables sharemap. The client hides the map, but the public JSON response still...

CVE-2026-71540

The Wazuh security platform is vulnerable to a memory exhaustion issue in versions 3.9.0 through 4.14.7 . The flaw exists in the wazuh-clusterd component (specifically in framework/wazuh/core/cluster/common.py), where the system allocates a payload buffer based on a 20-byte cluster protocol heade...

CVE-2026-54461

The Habitica habit tracker application (versions 4.172.1 through 5.48.2 ) is vulnerable to a Regex Injection leading to a Regular Expression Denial of Service (ReDoS) . The flaw exists in a query parameter on the /api/v3/groups/:groupId/members route, where input is not sanitized before being int...

CVE-2026-54461 Habitica: Regex Injection / ReDoS in Member Search

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a...

CVE-2026-54461

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a...

EUVD-2026-86323

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782

The @rsdoctor/rspack-plugin (prior to version 1.5.16 ) contains an unauthenticated HTTP API that exposes sensitive build information. The default Rsdoctor report server binds to all network interfaces (0.0.0.0 ) and provides a POST /api/data/key endpoint with no authentication and wildcard CORS. ...

CVE-2026-61782

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by "@rsdoctor/rspack-plugin" binds to all network interfaces "0.0.0.0" and serves a "POST /api/data/key" endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

Exploit for CVE-2026-94609

CVE-2026-94609 — authentik Privilege Escalation via Delegated...

CVE-2026-94611

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-91160

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

CVE-2026-91161

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/sessionId/groups/groupId/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group...

CVE-2026-63493

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...