CVE-2026-77518

MaxKB (open-source enterprise AI assistant) versions 2.10.2-lts and earlier are affected by an authorization bypass in the MCP tool-detail route, which fails to apply the per-resource authorization check used by the list route. A workspace user who knows another user's active MCP tool_id can retr...

CVE-2026-79319

Stencil core 4.43.5 is vulnerable to Incorrect Access Control...

CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61745

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-48976

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/reponotifier.go updates a notifier through UpdateOneIDid without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another...

CVE-2026-48975

The HomeBox home inventory system is vulnerable to a cross-tenant IDOR (Insecure Direct Object Reference) issue in versions prior to 0.26.0 . The flaw exists in MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete within backend/internal/data/repo/repo_maintenance_entry.go, whe...

CVE-2026-77560

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-55625

GoCD , a continuous delivery server, is affected by an authorization bypass in its internal material connection test APIs (/go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test) from version 16.1.0 through 26.1.0 . The APIs accept an arbitrary pipeline or pipeline...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) images by vulnerabilities in github.com/caddyserver/caddy/v2 package

Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark images by vulnerabilities in github.com/caddyserver/caddy/v2 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-27587 DESCRIPTION:...

CVE-2026-94394

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

CVE-2026-94394 MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

CVE-2026-94394

CVE-2026-94394 affects the MISP threat intelligence platform, specifically the ObjectReferencesController . When a regular user adds a reference between objects or attributes, MISP verifies access to the parent event but does not always enforce granular sharing group or distribution-level restric...

EUVD-2026-83911

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

Security Bulletin: Multiple Vulnerabilities affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.

Summary Due to the use of IBM® Runtime Environment Java™, CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms are vulnerable to multiple vulnerabilities. CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have updated the...

PT-2026-96243

Name of the Vulnerable Software and Affected Versions Stencil core version 4.43.5 Description Incorrect Access Control allows unauthorized users to access restricted resources or perform actions they are not permitted to execute. Recommendations At the moment, there is no information about a newe...

PT-2026-96260

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...