CVE-2026-62277

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277 LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277 LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277

The open-source web-based vehicle maintenance tracker LubeLogger (prior to version 1.6.8 ) contains an Insecure Direct Object Reference (IDOR) vulnerability in the PrintRecordStickers function within /Controllers/VehicleController.cs. While the system verifies that an authenticated caller can vie...

EUVD-2026-114565

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277 LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

CVE-2026-62277: hargata lubelog: LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied...

PT-2026-134232

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8 Description An authenticated user can cause cross-user disclosure of vehicle maintenance records. The PrintRecordStickers function in /Controllers/VehicleController.cs verifies if the caller can view the...

Undici Vulnerable To Cache Poisoning And Cross-user Disclosure Via Cross-origin Redirects

Impact When an originless "Agent" composes the redirect and cache interceptors as "composeredirect, cache" with a shared cache "type: 'shared'", the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then...

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects vulnerability discovered by ? in WordPress npm undici versions = 7.0.0, 7.30.1...

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

Impact When an originless Agent composes the redirect and cache interceptors as composeredirect, cache with a shared cache type: 'shared', the cache builds its key from the original request URL before the redirect handler changes the origin. The response produced after a redirect is then stored...

CVE-2026-109829 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-109829 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-109829 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-109829

The undici HTTP client library for Node.js is vulnerable to an Origin Validation Error in versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1. When an originless Agent uses a shared cache store with a compose(redirect(), cache()) configuration, the cache incorrectly uses the original request U...

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85671 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

CVE-2026-85671 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

CVE-2026-85624 Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList

Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes...