CVE-2026-81505

Convoy , a cloud-native webhooks gateway, is affected by a cross-tenant IDOR in the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. The handler authorizes the project in the URL but sources.Service.FindSourceByID() fetches the source solely by sourceID without verifying that its Pro...

CVE-2026-81505 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...

EUVD-2026-83051

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...

CVE-2026-93736

Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and...

CVE-2026-93688

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...

CVE-2026-10030

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2026-11378 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing...

CVE-2026-11375 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers...

CVE-2026-10853 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths...

CVE-2026-93736 Mealie before 3.21.0 Information Disclosure via Ratings Endpoint

Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and...

EUVD-2026-83026

Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and...

CVE-2026-93736

Mealie before 3.21.0 contains an information disclosure vulnerability in the ratings and favorites endpoints , where user ownership is not validated. An authenticated attacker can read any user's recipe ratings, favorites, and private recipe identifiers by specifying arbitrary user IDs in the URL...

CVE-2026-93736 Mealie before 3.21.0 Information Disclosure via Ratings Endpoint

Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and...

CVE-2026-10575 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers...

CVE-2026-10030 IBM MQ Console is vulnerable to privilege escalation

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2026-10030

IBM MQ versions 9.3 LTS, 9.4 LTS, 9.3 CD, 9.4 CD, and 10.0.0.0 are affected by an improper authorization flaw (CWE-285) in the REST API and Console component. An authenticated non-administrative user with only read-only console access can create and start queue managers on the host, leading to pr...

CVE-2026-10030 IBM MQ Console is vulnerable to privilege escalation

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

EUVD-2026-83131

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2026-10027 IBM MQ queue manager is vulnerable to unauthenticated remote code execution

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled...

Malicious code in test899-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...