EUVD-2026-78788

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2024-14029 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

EUVD-2024-55765

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2024-14029 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, causing the server to treat a request as having no message body and parse the chunked body as a subsequent request. When Tornado is deployed behind a proxy, this inconsistency enables HTTP request smuggling , which can lea...

CVE-2024-14029 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling...

CVE-2026-55178

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC/STAC APIs, and a map builder. Prior to 1.2.3 , multiple read and link endpoints authorized only the resource named in the request URL but failed to re-authorize a second caller-influenced dataset reached through a relation...

EUVD-2026-78592

XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can edit a page to change that page's rights without executing the normal document-saving authorization checks. The user can grant script righ...

cups: OpenPrinting CUPS: Remaining case-insensitive username matching in scheduler side paths (CVE-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-91993

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

Security Bulletin: Enterprise Content Managemant System Monitor for August 2026 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

CVE-2026-91993

Jpom through 2.11.12 is affected by a workspace isolation bypass on the /build/branch-list endpoint. The root cause is a failure to validate workspace ownership when resolving a repositoryId , allowing any authenticated user to reference repositories belonging to other workspaces. Attackers can e...

CVE-2026-52819

Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users target identifiers from a caller with viewothertimesheet but does not apply accessuser or verify that a ROLETEAMLEAD requester leads a team containing each target user...

CVE-2026-52828

Kimai (open-source time tracking application) prior to 2.58.0 contains a missing authorization check in ExportController::createExportTemplate() and ExportController::editExportTemplate(). The methods inherit only the class-level create_export permission, which is granted to ROLE_TEAMLEAD by defa...

CVE-2026-52828 Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate and ExportController::editExportTemplate inherit only the class-level createexport permission, which ROLETEAMLEAD receives by default, and omit the createexporttemplate permission required b...

CVE-2026-52821

Kimai , an open-source time tracking application, is affected by an improper authorization flaw in its preset-parent creation flow prior to version 2.57.0 . In ActivityController.php and ProjectController.php, the controllers check only the generic create_activity or create_project capability but...

CVE-2026-52820

Kimai , an open-source PHP/Symfony time-tracking application, is affected by an authorization bypass in the PATCH /api/timesheets/{id} and POST /api/timesheets endpoints (prior to 2.57.0 ). A user-supplied project ID is injected into ProjectRepository::getQueryBuilderForFormType(), where it appea...

CVE-2026-52820 Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/id and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType places that identifier in an unconditiona...