EUVD-2026-101250

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate,...

CVE-2026-110103 bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...

EUVD-2026-98033

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits...

CVE-2026-109664

Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to...

CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...

CVE-2026-109666

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are affected by a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce proper permission checks on inventory records, allowing authenticated users to modify inventory data beyond their assigned role permis...

PT-2026-111001

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.3 Frappe versions 14.x prior to 14.21.1 Description Improper access control in Email Template permissions allows any authenticated non-guest user to create and edit any Email Template. This enables attackers with...

EUVD-2026-97059

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any syssms row, erasing records of sent...

CVE-2026-108713

SuiteCRM versions through 7.15.2 and 8.x through 8.10.2 are vulnerable to a missing authorization vulnerability (CWE-862). The flaw exists in the setCampaignMarketingAndTemplate entry point, allowing authenticated users with low privileges to create and modify EmailMarketing records. Specifically...

EUVD-2026-96616

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

EUVD-2026-96554

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

PT-2026-109995

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.9.4 Description An authorization bypass allows low-privileged authenticated users to circumvent permission checks by assigning their own user ID to the owner field. This enables attackers to send requests to the...

CVE-2026-108634

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit the...

CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to...

PT-2026-109928

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can restore deleted AI prompt templates due to missing authorization. This is achieved by sending PUT requests to the '/airag/prompts/revertRecycleBin' endpoint...

CVE-2026-108655: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron...

PT-2026-109895

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can delete department permission bindings due to missing authorization. An attacker can retrieve row identifiers from an unguarded list endpoint and provide them...

EUVD-2026-78647

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification...

CVE-2026-107793

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's...

CVE-2026-107797 Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...