CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

CVE-2026-108692 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

CVE-2026-108692 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

CVE-2026-108692

1Panel-dev CordysCRM versions 1.9.0 before 1.9.2 are vulnerable to a missing authorization vulnerability (CWE-862) within eight ModuleFieldController /field/source data-source endpoints. The root cause is a lack of proper permission checks, allowing authenticated users who are denied specific mod...

EUVD-2026-96578

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/id to irreversibly remov...

EUVD-2026-96568

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST...

EUVD-2026-96566

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/permissionId/roleId to read rule names, columns, conditions,...

PT-2026-109999

Wukong HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards a...

CVE-2026-108712: Missing Authorization

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108711: Incorrect Authorization

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...

CVE-2026-108692: Missing Authorization

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

PT-2026-110118

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.1.2 Description An authorization bypass exists in the file includes/html/graphs/smokeping/auth.inc.php. The system incorrectly validates the source probe device rather than the rendered target device. This allow...

PT-2026-110026

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer ord...

CVE-2026-88826: Improper Neutralization of Input During Web Page Generation

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator...

flatpak security update

1.12.9-4.4 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271518 1.12.9-4.3 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267902 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-26743...

CVE-2026-108870: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

PT-2026-110193

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the saveDatarule handler of the SysDepartRoleController. This issue allows authenticated users with low privileges to modify department role data rules by sending...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

PT-2026-110057

Name of the Vulnerable Software and Affected Versions WP-Partner versions prior to 1.2.2 Description An issue exists where the software fails to sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perform SQL injection, enabling...

PT-2026-110114

Name of the Vulnerable Software and Affected Versions Plastic Labs Honcho versions prior to 3.3.1 Description An incorrect authorization issue exists where holders of peer- or session-scoped API keys can access workspace data. This occurs because the get or create workspace function only verifies...