EUVD-2026-61038

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-42164

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

CVE-2026-19870

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create...

EUVD-2026-58479

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, POST /api/v1/runs/:runParam/replay in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses prisma.taskRun.findUnique where: friendlyId: runParam without a...

CVE-2026-73558

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

EUVD-2026-58066

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

EUVD-2026-57924

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...

CVE-2026-19734 IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...

CVE-2026-18744

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — testfunc only checks ismycase, not ownership of kwargs'member'. Bypasses sharestatus; leaks embargoed vendor affected/not-affected + statement text cross-tenant...

CVE-2026-69119

Taubyte Tau v1.1.10 is affected by a missing authorization vulnerability in the services/auth HTTP service that lets any authenticated user read or permanently delete another tenant’s project by supplying an arbitrary project ID to GET and DELETE /projects/{id}. The GitHubTokenHTTPAuth middleware...

CVE-2026-19539

CVE-2026-19539 affects Roskus Prospero Flow CRM prior to 5.4.9. It is an IDOR where an authenticated user can read full ticket content, hijack tickets by reassigning company_id, and delete tickets belonging to other companies. Root cause: read/save paths do not constrain queries to the user’s com...

PT-2026-70031

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate tenant context in inbound requests. This allows an unauthenticated attacker to send specially crafted requests to spoof the tenant context,...

CVE-2026-18948 Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

EUVD-2026-55818

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

CVE-2026-18948

Feast: A flaw in serializing UDFs with dill enabling unsafe deserialization leads to unauthenticated RCE on the feature server and, via deserialization bypass, on the registry server. A remote attacker can store a malicious UDF, with the risk of cross-tenant data access and lateral movement in de...

CVE-2026-18948

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

CVE-2026-18941 Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

EUVD-2026-55815

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-18941

Feast and feast-operator expose a vulnerability due to default no_auth configuration, allowing unauthenticated access to feature-server, registry-server, and offline-server endpoints. The root cause is missing authentication, enabling a remote attacker to store a malicious User-Defined Function (...

CVE-2026-18941 Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...