CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

EUVD-2026-98895

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110101 Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-110101

The software Koillection (versions through 1.8.4 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is a lack of MIME restrictions on Datum file attachments , which allows authenticated users to upload HTML files. Attackers can use the POST /api/data/{id}/file en...

CVE-2026-110101

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-110101 Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-82416

FrankenPHP versions prior to 1.12.5 are vulnerable to a cross-request PHP session ID leak in worker mode. The root cause occurs when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time, causing frankenphp_reset_session_state() to be omitt...

CVE-2026-82416 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVEPHPSESSION at compile time. In this build configuration,...

CVE-2026-104867

The admin route "GET /api/admin/users/id/calendar-heatmap" is declared with "@Authenticated permission: Permission.UserRead " instead of "@Authenticated permission: Permission.AdminUserRead, admin: true ", and the service method behind it performs no ownership or role check. Every other endpoint ...

ROOT-OS-UBUNTU-2404-CVE-2026-45836 CVE-2026-45836 in linux - Patched by Root

Root has patched CVE-2026-45836 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-31715 CVE-2026-31715 in linux - Patched by Root

Root has patched CVE-2026-31715 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-71148 CVE-2025-71148 in linux - Patched by Root

Root has patched CVE-2025-71148 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-68218 CVE-2025-68218 in linux - Patched by Root

Root has patched CVE-2025-68218 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint

EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/id, which skips the...

CVE-2026-109959

EspoCRM versions 4.0.0 before 10.0.7 are vulnerable to an access control flaw. Authenticated users with stream access to a parent record can bypass the NoteAccessControl filter by requesting GET /Note/{id}. This allows them to read audited field values restricted by field-level security , specifi...

CVE-2026-109116

A vulnerability exists in the Order Management component of the AdithyaYelloju Restaurant-Management-System (up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c). The flaw resides in the mysqli_query function, where manipulating the ID argument allows for an authorization bypass . This attack c...

CVE-2026-109116 AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization

A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqliquery of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be...

thunderbird: Out-of-bounds read in IMAP response parser

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is...

CVE-2026-108959

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...