CVE-2026-119708 abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context an...

CVE-2026-110764

AstronRPA versions through 1.1.6 are vulnerable to a Cross-Tenant File Disclosure via the resource-service /file/download endpoint. The root cause is an Insecure Direct Object Reference (IDOR) in the FileMapper.getFile function, which fails to perform ownership or tenant checks. This allows authe...

CVE

CVE CVE-2017-16900: Hunesion i-oneNet Incorrect Access Con...