CVE-2026-116592

The undici HTTP client for Node.js is vulnerable to cache poisoning and cross-user disclosure in versions 7.30.1 and 8.12.2 through 8.12.3 . When an originless Agent uses both redirect and shared cache interceptors, the software incorrectly inspects only the final redirect hop to determine if a r...

EUVD-2026-117155

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-54378

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-54378

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to a broken access control flaw. By calling the POST /front/user/s3/token/ endpoint, any authenticated user can obtain temporary AWS credentials that are improperly scoped. This allows an attacker to list the shared storage bucke...

CVE-2026-103002

GPUStack, an open-source GPU cluster manager, is vulnerable to a missing authorization flaw in versions 2.2.0 through 2.2.2 . The cluster_apiserver_proxy component fails to perform resource-level authorization checks when forwarding requests from authenticated non-administrator users to a Kuberne...

CVE-2026-103002 GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, clusterapiserverproxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a...

CVE-2026-103002 GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, clusterapiserverproxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a...

WordPress Premium Packages plugin < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure vulnerability

Unauthenticated Cross-User Saved Cart Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin WPDM – Premium Packages versions 7.3.1...

PT-2026-137213

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description Broken access control allows authenticated users to obtain temporary AWS credentials via the 'POST /front/user/s3/token/' endpoint. These credentials have overly broad scopes, enabling...

CVE-2026-121458

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458

Versions of Instatic prior to 0.0.21 are vulnerable to a missing authorization flaw in the AI/MCP content read tools . The root cause is a lack of object-level authorization checks in the content_get_document and content_list_documents functions, which are otherwise enforced by the standard HTTP ...

CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

EUVD-2026-115812

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2025-46818

CVE-2025-46818 – Redis Lua Sandbox Cross-User Escape Sandbox escape via deprecated Lua APIs and mutable metatables on Redis 8.2.1. Overview Redis 8.2.1 keeps deprecated Lua builtins getfenv, setfenv, newproxy exposed to scripts and fails to lock metatables for basic types. An attacker can inject...

CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 Data Leakage Vulnerability Overview CVE-2024-52317 is a vulnerability affecting Apache Tomcat's HTTP/2 implementation. The issue arises due to improper recycling of HTTP/2 request and response resources, potentially leading to data leakage...

ASB-A-435188844

In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-33555

HTTP Request Smuggling via HAProxy H3/QUIC Standalone FIN Body Validation Bypass Full post here : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Summary A vulnerability in HAProxy's HTTP/3 implementation allows an attacker to send an HTTP request with a...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...