CVE-2026-108388: Incorrect Authorization

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.canmanage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user t...

CVE-2026-109350

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

CVE-2026-109338

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get, entries, values, or getSetCookie, or return them...

CVE-2026-109319

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via...

CVE-2026-109338

SurrealDB versions prior to 3.3.0 are vulnerable to a Denial of Service (DoS) flaw. The issue stems from the handling of non-ASCII header values within embedded JavaScript . Query-capable users with scripting enabled can trigger a server crash by accessing these values through functions such as H...

CVE-2026-109178

Versions of jshERP through 3.6 are impacted by a missing authorization vulnerability within the LogController . This flaw allows any authenticated user, including those with low privileges, to access endpoints such as /log/add, /log/update, /log/delete, and /log/deleteBatch. Attackers can exploit...

CVE-2026-78358

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...

UBUNTU-CVE-2026-78358

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...

CVE-2026-78358

The OTRS help desk software (versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and Community Edition 6.x and earlier) is vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is the lack of ChallengeToken validation on several administrative endpoints, specifical...

CVE-2026-109338: Uncaught Exception

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get, entries, values, or getSetCookie, or return them...

CVE-2026-78358: Cross-Site Request Forgery (CSRF)

Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can...

PT-2026-110490

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x Description Several administrative actions fail to sufficiently validate if a request was intentionally initiated by an authenticated user. Specifically, the DBUpdateLogCleanUp...

EUVD-2026-96561

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...

CVE-2026-108643

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to...

CVE-2026-108622

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...

CVE-2026-108643 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to...

CVE-2026-108643

JeecgBoot through version 3.9.5 is vulnerable to a missing authorization flaw (CWE-862). This allows low-privileged authenticated users to perform unauthorized deletions of category dictionary entries via the DELETE /sys/category/deleteBatch endpoint. Attackers can identify target node IDs using ...

CVE-2026-108643 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to...

CVE-2026-108622 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...

CVE-2026-108622 JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen syslog records to...