CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

CVE-2026-54050

Sakai (a Collaboration and Learning Environment) has an IDOR in its REST API: the DELETE /api/users/{userId}/profile/image endpoint in ProfileController.removeProfileImage() passes the attacker-controlled userId to the service layer without verifying ownership, allowing any authenticated user to ...

CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

CVE-2026-54076

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

CVE-2026-63696

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-54076

ArcadeDB (Multi-Model DBMS) versions prior to 26.6.1 suffer from an incomplete authorization fix for CVE-2026-44221. The UPDATE_SCHEMA permission check was added only to LocalDocumentType.createProperty, leaving other public schema mutators in LocalDocumentType.java and LocalProperty.java unprote...

CVE-2026-63696

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-63696

Dell SmartFabric OS10 versions prior to 10.6.1.3 contain a Download of Code Without Integrity Check vulnerability. A high-privileged attacker with remote access could exploit it to achieve arbitrary code execution , with a CVSS v3.1 score of 9.1 (Critical) due to changed scope and high impact on ...

CVE-2026-63696

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

EUVD-2026-78772

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

CVE-2026-92059

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

CVE-2026-52825

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

CVE-2026-75983

The Eventin WordPress plugin (≤ 4.1.23 ) contains a privilege escalation vulnerability in PermissionManager::manage_permissions(), which is hooked into WordPress's map_meta_cap filter and unconditionally returns an always-true primitive for user ID 1 without scoping to plugin-specific capabilitie...

EUVD-2026-78298

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the PermissionManager::managepermissions function being registered as a callback on WordPress core's...

EUVD-2026-78282

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...