CVE-2026-55381

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...

CVE-2026-102986

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...

CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-110772

A flaw was found in sure. A missing authorization check in the bulk update functionality allows authenticated users with restricted or read-only permissions to bypass account sharing restrictions. By submitting arbitrary transaction identifiers during a bulk update request, an attacker can modify...

CVE-2026-102986

The open-source project management tool Plane (versions 1.3.1 and earlier) contains an authorization bypass in the EntityAssetEndpoint at the /api/public/assets/v2/anchor/{anchor}/ endpoint. While the endpoint requires authentication for write operations, it fails to verify workspace or project m...

CVE-2026-102986 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

EUVD-2026-101614

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-102986 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-55381 InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...

CVE-2026-55381

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...

CVE-2026-103974

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...

CVE-2026-110773 GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

EUVD-2026-101572

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members'...

CVE-2026-103930 cpp-httplib open_stream serializes CRLF in request target into HTTP request line

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-108151

Improper Control of Generation of Code 'Code Injection' vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9...

CVE-2026-103974 lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by...

CVE-2026-103974

The chess server lichess.org is vulnerable to Stored HTML Injection in its study features. An attacker who can add a chapter to a study can place malicious text within the PGN Annotator tag , which is then stored as Comment.Author.External. When a study node contains at least two comments, the fi...