CVE-2026-108164: Authorization Bypass Through User-Controlled Key

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

CVE-2026-108624: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remov...

PT-2026-109886

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can modify message push records due to missing authorization. By calling the endpoint "PUT /sys/message/sysMessage/edit", an attacker can provide any sys sms reco...

PT-2026-109880

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can delete message templates due to missing authorization. This is possible via the 'DELETE /sys/message/sysMessageTemplate/deleteBatch' endpoint. By providing...

PT-2026-117772

Security vulnerability affects the apache-nifi package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...

PT-2026-109885

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysMessageController. This issue allows authenticated users with low privileges to delete message push records, including those pendin...

CVE-2026-108618: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titl...

PT-2026-109879

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can modify message templates due to missing authorization. By accessing the unguarded list endpoint to obtain template IDs, an attacker can use the PUT...

PT-2026-109903

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysAnnouncementSendController that allows authenticated users to modify message delivery records belonging to other users. An attacker can retrieve delivery...

PT-2026-109887

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysMessageController. This issue allows authenticated users with low privileges to access any message push record by providing arbitrary...

CVE-2026-108617: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes...

CVE-2026-108626: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose messa...

PT-2026-109878

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users with low privileges to create message templates. By calling the POST '/sys/message/sysMessageTemplate/add' endpoint, an attacker can insert arbitrar...

CVE-2026-108619: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint...

CVE-2026-108625: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

PT-2026-109902

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded...

CVE-2026-108642: Authorization Bypass Through User-Controlled Key

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite...

Linux Distros Unpatched Vulnerability : CVE-2026-106428

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...

PT-2026-109650

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequenti...

MGASA-2026-0479 Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...