CVE-2026-82877

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import...

CVE-2026-82871 ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

CVE-2026-65646

A flaw was found in Plesk. Improper neutralization of special elements allows remote authenticated users to disclose arbitrary local files. This vulnerability can also lead to privilege escalation within the system...

PT-2026-83746

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join tables endpoint that grants JOIN TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82882: Missing Authorization

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

PT-2026-83669

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

EUVD-2026-68244

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

CVE-2026-82633

Dolibarr versions 10.0.0 through 23.x fail to perform per-object authorization checks in the Users::getGroups REST API endpoint (GET /users/{id}/groups). Any authenticated user can call this endpoint with arbitrary user identifiers to retrieve group memberships, entity associations, and private n...

CVE-2026-82633

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

EUVD-2026-68201

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633: Missing Authorization

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-80488: Improper Neutralization of Special Elements used in an SQL Command

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-55867

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

EUVD-2026-68014

Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/userId/tokens/idOrToken endpoint implemented by UsersResource.revokeToken in graylog2-server/src/main/java/org/graylog2/rest/resources/users/UsersResource.java checks USERSTOKENREMOVE...

EUVD-2026-42986

Snipe-IT has missing object-level authorization in Kits API...

EUVD-2026-42994

Snipe-IT has an authorization bypass on print inventory page...

GHSA-FC33-6W3Q-538H Snipe-IT has an authorization bypass on print inventory page

Impact An authenticated user with only users.view can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license name...

Snipe-IT has an authorization bypass on bulk editing users

Impact An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update. Attacker Model...

CVE-2026-82283

VoltAgent through 2.1.20 contains an authorization flaw in its memory API handlers , which fail to validate conversation ownership . An authenticated attacker can supply caller-controlled identifiers to memory endpoints to read, modify, or delete conversations and messages belonging to other user...