CVE-2026-101112

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ...

CVE-2026-101112

The Joomla Extension - balbooa.com - Balbooa Forms version

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an incorrect authorization check that allows an authenticated user with only read permission for a project to modify a workflow instance. By accessing the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to e...

EUVD-2026-88817

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-86843 Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

CVE-2026-96429

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

EUVD-2026-88658

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96429

Flowring Agentflow 4.0 (versions prior to 2025/08/08 ) is vulnerable to SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint. This flaw allows remote attackers to execute arbitrary SQL commands by manipulating the id parameter. The vulnerability has a CRITICAL base severity score ...

DEBIAN-CVE-2026-97029

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processe...

UBUNTU-CVE-2026-97029

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processe...

CVE-2026-97029

A vulnerability in Flatpak allows a sandboxed application to bypass process ID namespace separation . Specifically, the kill(0, signal) or killpg(0, signal) calls can reach processes outside the sandbox if they share the same process group . A malicious or compromised Flatpak app can exploit this...

EUVD-2026-88597

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

CVE-2026-102373

GestSup versions before 3.2.62 are vulnerable to a private ticket comment disclosure flaw due to a failure to validate ticket ownership when loading comments via the threadedit parameter in thread.php . Authenticated attackers can exploit this by enumerating sequential comment IDs to read private...