CVE-2026-113602

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating...

CVE-2026-111764

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO Authentication Bypass Executive Summary FortiCloud Single-Sign-On SSO a factory default enabled feature once you register any FortiGate/FortiManager/FortiAnalyzer contains a critical authentication-bypass flaw. An attacker who owns any FortiCloud account free or pa...

CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...

CVE-2026-112957

The ApostropheCMS Node.js content management system contains a vulnerability in the getOne REST endpoint for pages prior to version 4.34.0 . The root cause is a failure to apply viewRole type-level restrictions and viewPermission field-level redaction. Consequently, a user with editor-level privi...

CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document id can read the full content of admin-only page...

CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to...

CVE-2026-113703

SuggestArr versions prior to 3.0.0 are vulnerable to an authentication bypass in the local_bypass mode. The root cause is located in api_service/auth/middleware.py, where the enforce_authentication() function trusts the request.remote_addr value. This value is derived from a spoofable X-Forwarded...

CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to...

EUVD-2026-105106

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its localbypass authentication mode where enforceauthentication in apiservice/auth/middleware.py trusts the client-controlled request.remoteaddr value, which is derived from the spoofable X-Forwarded-For header due to...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...

CVE-2026-90800

Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to an authentication bypass in the chttpd component. The root cause is missing authorization checks, which allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorized API endpo...

CVE-2026-90800 Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...

CVE-2026-90800 Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...

CVE-2026-113682 Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an...

CVE-2026-113682

The networknt light-4j library, from version 2.1.5 before 2.4.0 , contains an authentication bypass vulnerability in the BasicAuthHandler component. The root cause allows unauthenticated attackers to log in as LDAP/AD-delegated users by sending a Basic Authorization header with a known username a...

EUVD-2026-105098

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an...

CVE-2026-113676

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to an authorization bypass in the Admins.get API command. This vulnerability is caused by identifier confusion , allowing authenticated resellers to read sensitive records belonging to other administrators. By providing their own loginname comb...

EUVD-2026-105092

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...