CVE-2026-94497 jshERP through 3.6 Unauthorized Access via by-id Endpoints

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks...

CVE-2026-94497

jshERP through 3.6 suffers from a broken object-level authorization (IDOR) flaw in its by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, or delete other users' business objects by submitting direct object identifiers without proper owne...

EUVD-2026-84047

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

SUSE CVE-2026-72799

SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader - or any...

cve-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read CVSS 10.0 · Unauthenticated · Actively exploited CISA KEV A parser differential between GitLab Workhorse Go reverse proxy and Puma/Grape Ruby lets an unauthenticated attacker bypass Workhorse's accelerated-upload handoff and reach three...

CVE-2026-63416 draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

CVE-2026-94501: Missing Authorization

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain a missing authorization vulnerability in three whitelisted timesheet endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) that fail to enforce doctype permissions. An authenticated attacker...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113: Missing Authorization

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

PT-2026-95969

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.0 Frappe ERPNext versions 16.x prior to 16.34.0 Description An information disclosure issue exists in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can...

SUSE CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 — OpenAM Pre-Auth RCE Pre-authentication Remot...

CVE-2026-94000

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

EUVD-2026-83601

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

EUVD-2026-83567

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...

CVE-2026-1256 YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...

CVE-2026-1256

YS LeadGen – Popups, Opt-ins & Lead Capture for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.4 due to missing capability checks on popup management AJAX endpoints. Authenticated users with Subscriber-level or higher access can create arbitra...

CVE-2026-92420

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...