CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/ routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or...

CVE-2026-111623

The Xiaozhi-esp32-server-java software (versions through 6.1.0 ) is vulnerable to an authentication bypass (CWE-290) in the OTA endpoint . An unauthenticated attacker can obtain valid device WebSocket tokens by requesting /api/device/ota using any arbitrary MAC address. Successful exploitation al...

EUVD-2026-103045

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...

CVE-2026-111620

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620 O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620 O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620

O2OA versions up to and including 10.0.2-ce are vulnerable to an authorization bypass (CWE-639) in the x_processplatform_assemble_surface component. The vulnerability exists because the ActionDownloadWithWork and ActionDownloadWithWorkStream functions fail to verify if a requested attachment ID b...

EUVD-2026-103042

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

EUVD-2026-103038

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...

CVE-2026-111616

The Oqtane Framework through version 10.2.6 contains an authorization bypass vulnerability within the SettingController . This flaw allows an attacker with the Administrators role on one site to access another co-tenant site's private settings by requesting a different site's entityId through the...

CVE-2026-111616 Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to...

CVE-2026-111605 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111604

The eladmin framework, versions through 2.7 , is vulnerable to an authorization bypass (CWE-639) within the /api/users endpoints. The root cause is that write handlers skip mandatory department checks , allowing department-scoped user managers to exceed their intended data scope. An attacker poss...

CVE-2026-111605

Jpom versions through 2.11.12 are vulnerable to a cross-workspace authorization bypass in the SshFileController component. This vulnerability allows authenticated users to access SSH hosts belonging to different workspaces by providing unauthorized SSH asset IDs. Attackers with SSH file permissio...

EUVD-2026-103026

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

EUVD-2026-103027

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

CVE-2026-111605 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload,...

EUVD-2026-103023

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...

CVE-2026-109839 IBM Db2 Genius Hub Missing Cryptographic Step

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...