EUVD-2026-117155

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-54378

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-54378

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to a broken access control flaw. By calling the POST /front/user/s3/token/ endpoint, any authenticated user can obtain temporary AWS credentials that are improperly scoped. This allows an attacker to list the shared storage bucke...

PT-2026-137213

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description Broken access control allows authenticated users to obtain temporary AWS credentials via the 'POST /front/user/s3/token/' endpoint. These credentials have overly broad scopes, enabling...

EUVD-2026-76989

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-85607

Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require ...

CVE-2026-73308

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in...

CVE-2025-26454

The Google Android operating system is vulnerable to a local escalation of privilege due to a confused deputy flaw in the validateUriSchemeAndPermission function of the DisclaimersParserImpl.java module. This vulnerability allows an attacker to access data from another user without requiring addi...

CVE-2025-20894: Undefined Security Weakness

Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles...

CVE-2024-34674: Undefined Security Weakness

Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles...

CVE-2020-4809

IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633...

CVE-2020-4765

IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902...