EUVD-2026-96600

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, includin...

EUVD-2026-96579

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes,...

EUVD-2026-96572

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button...

EUVD-2026-96554

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other user...

PT-2026-109993

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.9.4 Description An issue exists where the application lacks a PROCESS SETTING permission check on the 'POST /approval-flow/webhook/test' endpoint. This allows any authenticated user to trigger server-side requests...

PT-2026-109986

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

PT-2026-109995

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.9.4 Description An authorization bypass allows low-privileged authenticated users to circumvent permission checks by assigning their own user ID to the owner field. This enables attackers to send requests to the...

IBM Langflow OSS 1.12.2 Authenticated Code Execution

IBM Langflow OSS versions 1.0.0 through 1.12.2 allow a remote authenticated attacker to execute arbitrary code due to improper access control. This proof of concept submits a malicious custom component and verifies target-side shell deployment. https://packetstorm.news/download/235110...

PT-2026-110172

🚨 CVE-2026-108853 UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed...

PT-2026-110120

🚨 CVE-2026-108717 Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and...

PT-2026-110115

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

PT-2026-110137

Name of the Vulnerable Software and Affected Versions Frappe CRM versions 1.49.0 through 1.87.0 Description An issue exists where authenticated users can read linked documents without proper permission checks. By specifying a lead, deal, comment, or user they are not authorized to access, an...

PT-2026-110113

Name of the Vulnerable Software and Affected Versions NornicDB versions prior to 1.4.2 Description Authenticated users can bypass per-database read restrictions. Users with a viewer role who are allowlisted for a database but denied read access can retrieve node IDs, labels, and full property map...

PT-2026-110044

Name of the Vulnerable Software and Affected Versions Adwised Web Push Notification versions prior to 2.5.8 Description An authenticated user, including those with subscriber-level privileges, can overwrite site-wide configuration settings because the plugin fails to perform capability or nonce...

CVE-2026-108731: Missing Authorization

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the canonlyjoinviainvite setting. Attackers with the Raven User role can call the joinworkspace method to become persistent members, reading a...

CVE-2026-108734: Missing Authorization

Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.getlinkeddocsofdocument that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log...

CVE-2026-108710: Missing Authorization

NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node ID...

CVE-2026-108752: Use of Multiple Resources with Duplicate Identifier

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

HDKEM: Authentication Allocation for Deniable Hybrid Key Exchange

Deniable authenticated key exchange DAKE establishes a shared key without leaving transferable evidence that a party participated. We study DAKE protocols that authenticate each fresh session with one ring signature and show that their deniability mechanisms fall into three authentication...

CVE-2026-108705: Missing Authorization

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...