CVE-2026-116196

Rclone versions prior to v1.75.2 are vulnerable to a credential exposure flaw in the b2 backend . When using the --b2-download-url option, the application may leak live account Authorization tokens and SSE-C keys during HTTP redirects. Specifically, attackers can capture cleartext B2 tokens via s...

CVE-2026-116196 Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token,...

CVE-2026-105637

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

CVE-2026-105637

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

CVE-2026-105637 Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

CVE-2026-105637

The open-source project management tool Plane is vulnerable to Cross-Project Asset Hijacking in versions prior to 1.4.0 . The root cause lies in the ProjectBulkAssetEndpoint.post function within apps/api/plane/app/views/asset/v2.py, which fails to constrain asset queries with the project_id from ...

EUVD-2026-92578

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

CVE-2026-105637 Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

CVE-2026-105637 Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

PT-2026-106084

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id in=asset ids and workspace slug=slug but does not constrain the query with project id from the URL. A workspace Guest can provide asset...

CVE-2026-105637: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-85415

The Audio Player Block WordPress plugin, in versions prior to 1.6.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate the scheme of a user-supplied URL before using it as a link target. This allows users with the Contributor role or higher to store mal...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-84025 BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

CVE-2026-72689

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

EUVD-2026-51201

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

CVE-2026-16074

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-16074 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-16074

CVE-2026-16074 affects AstrBot up to version 4.25.2. The vulnerability lies in the function update_plugin/update_all_plugins (file astrbot/dashboard/routes/plugin.py) where manipulation of the arguments download_url/download_urls/proxy enables server-side request forgery (SSRF). Exploitation may ...