CVE-2026-94535 lamp-cloud through 5.10.0 Unauthorized Notification Deletion

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

CVE-2026-94535

lamp-cloud through 5.10.0 contains an authorization bypass (BOLA) in the deleteMyNotice endpoint. An attacker with valid credentials can call DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs, permanently deleting notifications belonging to other users because the backend perfo...

CVE-2026-94532

lamp-cloud through 5.10.0 contains an authorization bypass in the getUserInfoById endpoint of its OAuth module. Any authenticated user can iterate the userId parameter to retrieve other users' full profiles, exposing mobile numbers, email addresses, national identity card numbers, and WeChat/Ding...

CVE-2026-94497 jshERP through 3.6 Unauthorized Access via by-id Endpoints

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks...

CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in its role management endpoints (/role/update and /role/delete), allowing any authenticated user to modify or delete any role 's data scope. An attacker can escalate privileges by changing a role's data visibility to cover all records, gain...

CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs

GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...

EUVD-2026-83942

Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...

CVE-2026-94497: Authorization Bypass Through User-Controlled Key

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks...

CVE-2026-94394: Missing Authorization

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access...

CVE-2026-92423: Exposure of Sensitive Information to an Unauthorized Actor

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-40530

An improper neutralization of CRLF sequences 'CRLF injection' vulnerability in User API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the...

CVE-2026-40537

A server-side request forgery (SSRF) vulnerability exists in the PersonMail API component of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . A remote authenticated user can leverage this flaw to obtain non-sensitive information . The vulne...

EUVD-2026-82789

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-40532

A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...

CVE-2026-4036

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-13666

CVE-2026-13666 is a CRLF Injection vulnerability in the Sharing API of Synology DiskStation Manager (DSM) . A remote authenticated user can write limited files when a victim clicks a crafted sharing URL. The CVSS 3.1 score is 3.5 (Low) with the vector requiring network access, low complexity, low...

CVE-2026-40534: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-77170: Improper Access Control

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...