CVE-2026-105635: Exposure of Sensitive Information to an Unauthorized Actor

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

PT-2026-106082

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/project id/join/pk/ uses permission classes = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-104955: Improper Privilege Management

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-105698: Authorization Bypass Through User-Controlled Key

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

CVE-2026-93319: Unsynchronized Access to Shared Data in a Multithreaded Context

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-104966: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

PT-2026-104810

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

PT-2026-104756

Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10...

PT-2026-104748

Name of the Vulnerable Software and Affected Versions Papermerge version 3.5.3 Description A standard user can achieve remote code execution through a directory traversal flaw in the '/api/documents/upload' endpoint. This allows an attacker to write a Python .pth file into the site-packages...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

CVE-2026-88394

WookTeam versions v1.6.6 and before are vulnerable to a Directory Traversal flaw within the project task export endpoint (/api/project/task/export). The root cause is the lack of path normalization or directory boundary checks when processing the data parameter. Specifically, a crafted JSON paylo...

CVE-2026-88393

WookTeam version 1.6.6 and before is vulnerable to Remote Code Execution (RCE) via the project task export interface at /api/project/task/export. The root cause is that the data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php. This function ...

PT-2026-106003

Name of the Vulnerable Software and Affected Versions WookTeam versions prior to 1.6.7 Description The project task export interface '/api/project/task/export' allows remote code execution. The data parameter is base64-decoded and passed to the string2array function in app/Module/Base.php. When t...

PT-2026-106230

Name of the Vulnerable Software and Affected Versions dotnet eShop version .NET 8 Description An issue exists in the Ordering API component within the GetOrderAsync function located in the src/Ordering.API/Apis/OrdersApi.cs file. A remote attacker can manipulate the OrderNumber argument to cause...

PT-2026-106083

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description The webhook delivery task in apps/api/plane/bgtasks/webhook task.py uses the requests.post function without setting allow redirects=False and fails to validate redirect targets. While the validate url...

PT-2026-106191

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

PT-2026-106044

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

CVE-2026-88394: Improper Limitation of a Pathname to a Restricted Directory

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

CVE-2026-105761: Authorization Bypass Through User-Controlled Key

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps//server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to t...

CVE-2026-105447: Incorrect Authorization

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the buil...