CVE-2026-67347 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

CVE-2026-67347 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

CVE-2026-67347

Vendure 3.7.1 contains a cross-channel authorization bypass. In stock-location.service.ts and asset.service.ts update methods, channel-scoped administrators can supply global IDs from different channels to overwrite inventory locations or catalog assets belonging to other tenants, bypassing chann...

CVE-2026-67347 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

CVE-2026-65887

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

PT-2026-65800

Name of the Vulnerable Software and Affected Versions Gridbox versions prior to 2.20.2 Description An issue exists in the resetPassword method that allows unauthenticated actors to reset the password of any user, enabling them to log in and perform actions as those users, with the exception of...

CVE-2026-66028

The CVE-2026-66028 entry affects Ekushey Project Manager CRM up to version 5.0. A missing uniqueness constraint on the client email allows authenticated administrators to create duplicate accounts sharing the same email with different passwords. This enables conflicting account states and unpredi...

CVE-2026-66028 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement t...

CVE-2026-66398

CVE-2026-66398 affects phpMyFAQ releases before 4.1.6. Affected component: configuration API. Root cause: an authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can abuse upgrade.lastDownloadedPackage to write arbitrary PHP files. Attack flow: upload a malicious ZIP ...

CVE-2026-55985

CVE-2026-55985 affects Tycon Systems TPDIN-Monitor-WEB2: the web management interface stores and displays system credentials in cleartext on a configuration page accessible to authenticated users. This exposure enables anyone with access to the administrative dashboard to read credentials, potent...

CVE-2026-65711

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via stri...

CVE-2026-65711 sysPass 3.2.11 Authenticated OS Command Injection via Backup Path

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via stri...

CVE-2026-15906

CVE-2026-15906 affects the WordPress plugin “Premium Packages – Sell Digital Products Securely” up to version 7.0.4. The issue is a generic SQL injection via the orderby parameter caused by insufficient escaping and lack of proper SQL query preparation. This allows authenticated attackers with ad...

CVE-2026-28309

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments...

Exploit for CVE-2026-60137

Compromise Scanner for wp2shell read-only A standalone, r...

EUVD-2026-45226

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

CVE-2026-16104

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

CVE-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

CVE-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...