CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

EUVD-2026-84794

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

Malicious Package

Overview take-home-caller-id is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

SUSE CVE-2026-90425

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241vintfinitvsid maps a guest vSID to a single physical Stream ID taken from master-streams0, and only warns when the device does not have exactly one stream. A...

CVE-2026-95655 Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes ...

EUVD-2026-84526

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes ...

CVE-2026-95655

Aureus ERP before 1.5.0 contains an IDOR vulnerability in the ChatterPanel Livewire component (Webkul Chatter plugin). Message lookups are not scoped to the current record, allowing any authenticated user to submit sequential message IDs and read, edit, delete, or pin messages belonging to other ...

Malicious code in take-home-caller-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads...

MAL-2026-16382 Malicious code in take-home-caller-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads...

EUVD-2026-84378

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to POST...

PT-2026-97044

Name of the Vulnerable Software and Affected Versions s2n-quic versions prior to 1.89.0 Description Improper validation of the Destination Connection ID length allows an unauthenticated remote user to cause a denial of service by shutting down a server endpoint using a single crafted UDP datagram...

CVE-2026-19202: Use of Cache Containing Sensitive Information

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...

PT-2026-97117

Name of the Vulnerable Software and Affected Versions itsourcecode Leave Management System version 1.0 Description A remote SQL injection exists in the /module/leavetype/index.php endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL command...

PT-2026-96674

Name of the Vulnerable Software and Affected Versions WP-CRM System – Manage Clients and Projects versions prior to 3.4.7 Description Authenticated attackers with contributor-level access and above can extract sensitive data from arbitrary CRM contact records. This is achieved by enumerating the...

PT-2026-96925

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description OAuthConfig writes a plaintext fallback file containing access token and refresh token within the user's .mcp-atlassian directory. This file is created using process-default permissions rather...

PT-2026-97017

Name of the Vulnerable Software and Affected Versions Spree versions 5.4.0 through 5.4.3 Spree versions 5.5.0 through 5.5.3 Description An authenticated customer can associate an eligible guest cart with their own account and access the billing and shipping address data stored within that cart...

PT-2026-97091

Name of the Vulnerable Software and Affected Versions mcp-toolbox-sdk-python affected versions not specified Description A caching flaw in the toolbox-core package allows a Google ID token to be cached and reused across different audiences within the same process. The module-level token cache fai...

CVE-2026-94627

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...