CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

CVE-2026-94497

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks...

CVE-2025-46818

CVE-2025-46818 – Escape del sandbox Lua de Redis entre usuarios Escape del sandbox mediante APIs Lua obsoletas y metatablas mutables en Redis 8.2.1. Resumen Redis 8.2.1 mantiene expuestos a los scripts los builtins Lua obsoletos getfenv, setfenv, newproxy y no bloquea las metatablas de los tipos...

CVE-2024-11222

GitLab CE/EE is affected by a Time-of-check Time-of-use (TOCTOU) race condition in pipeline creation, impacting versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . Under certain conditions, a developer user could perform actions in the context of another user's merge re...

CVE-2026-76855 Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data...

CVE-2026-12763

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is affected by improper cache key isolation in the MCP Tools component . The component caches discovered MCP tools in a shared process-local cache keyed only by the MCP server display name, without incorporating the user, session, flow, or resolved...

CVE-2026-55235

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235

langgraph-api (the LangGraph Server runtime) prior to 0.10.0 allows a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport. The authentication middleware treats this transport as internal, so the webhook reaches the server's own thread and ru...

EUVD-2026-77585

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-49463

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

PYSEC-2026-3857 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

SummaryIn affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

CVE-2026-86994

n8n , an open-source workflow automation platform, contained a missing userId filter that allowed cross-user information disclosure. The /rest/active-workflows endpoint returned every active workflow ID on the instance to any authenticated member regardless of sharing permissions, and lifecycle p...

CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-61688

SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...

CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...