CVE-2026-116018

The ONEARMY community-platform (versions before 2.165.2 ) contains an insecure direct object reference (IDOR) vulnerability in the notification read endpoint. Authenticated users can exploit this via POST /api/notifications/:id/read to mark other users' notifications as read. By iterating through...

CVE-2026-35584

CVE-2026-35584 POC - CVE-2026-35584 FreeScout Description Summary The endpoint GET /thread/read/conversationid/threadid does not require authentication and does not validate whether the given threadid belongs to the given conversationid. This allows any unauthenticated attacker to: Mark any threa...

GO-2026-6747 Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint v1 and v2 and escalate to the share's permission level in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mappe...

CVE-2026-100622

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

CVE-2026-100622 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

EUVD-2026-87717

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

CVE-2026-100622 capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

CVE-2026-100622

Versions of capgo.app through 12.129.0 are vulnerable to a flaw where the application fails to verify the deletion status of bundle artifacts when serving them from the public file read endpoint . This allows unauthenticated attackers to download deleted bundles using cached URLs. Furthermore, ca...

CVE-2026-100622: Exposure of Sensitive Information to an Unauthorized Actor

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits...

PT-2026-99293

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.129.0 Description The application fails to verify the deletion status when serving cached bundle artifacts from the public file read endpoint. This allows unauthenticated attackers to download bundles that have...

CVE-2026-92750: Missing Authorization

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...

GHSA-37RX-7PJ5-P885 Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qfwc-vx6f-3g6g. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints,...

Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qfwc-vx6f-3g6g. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints,...

CVE-2026-85583

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace a...

CVE-2026-85583

SiYuan versions prior to v3.8.2 are affected by a path traversal vulnerability in the reader-accessible file-read endpoint. The root cause is that the endpoint follows symlinks when opening authorized asset paths, allowing an attacker with the reader role to request a logical asset under data/ass...

CVE-2026-85583 SiYuan before v3.8.2 Path Traversal via symlink in file API

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace a...

CVE-2026-85583 SiYuan before v3.8.2 Path Traversal via symlink in file API

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace a...

EUVD-2026-71006

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace a...

CVE-2026-85583 SiYuan before v3.8.2 Path Traversal via symlink in file API

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace a...

CVE-2026-41262

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...