19563 matches found
CVE-2026-75480
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...
CVE-2026-75106
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...
CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...
EUVD-2026-60392
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...
CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...
CVE-2026-75480
OpenViking's debug vector scroll and count endpoints in viking_vector_index_backend.py use account-level scoping without per-user access controls, allowing any authenticated user to read private memories, resources, skills, and secret material belonging to co-tenants. CVSS 6.5; exploitation in th...
EUVD-2026-60391
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...
EUVD-2026-60386
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...
MINI-5246-G457-CX45
Bulletin has no description...
CVE-2026-51346
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.16.20...
WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.22...
MINI-75X2-6G3G-CJ44
Bulletin has no description...
MINI-WQC9-C5GF-7QWJ
Bulletin has no description...
MINI-MJVC-Q92V-QG9F
Bulletin has no description...
MINI-79MX-RV28-327G
Bulletin has no description...
MINI-54HP-7QCP-GPVF
Bulletin has no description...
MINI-Q6P8-MXXH-HFJJ
Bulletin has no description...