CVE-2026-49225 Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

PT-2026-77203

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product question.sql queries...

CVE-2026-75480

OpenViking's debug vector scroll and count endpoints in viking_vector_index_backend.py use account-level scoping without per-user access controls, allowing any authenticated user to read private memories, resources, skills, and secret material belonging to co-tenants. CVSS 6.5; exploitation in th...

CVE-2026-75480 OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

BIT-OPENBAO-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

CVE-2026-74790

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...

CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...

UBUNTU-CVE-2026-74248

OpenStack Octavia through 18.0.0 mishandles quality of service QoS policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected...

CVE-2026-19870

The CVE-2026-19870 entry concerns Roskus Prospero Flow CRM (vendor Roskus) prior to version 5.15.10. It is an IDOR in the payroll module where authenticated users with read payroll permission can view salary and banking details of employees from other companies, and users with create payroll perm...

EUVD-2026-58621

Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create...

CVE-2026-73841

OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter...

CVE-2026-73659 Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

EUVD-2026-58482

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

EUVD-2026-58479

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, POST /api/v1/runs/:runParam/replay in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses prisma.taskRun.findUnique where: friendlyId: runParam without a...

CVE-2026-73654

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPathoperation.key.setnewMetadata, value in...

EUVD-2026-58358

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPathoperation.key.setnewMetadata, value in...

CVE-2026-73654

CVE-2026-73654 affects Trigger.dev platform (versions 3.3.8–4.5.6). The vulnerability arises in PUT /api/v1/runs/:runId/metadata where attacker-controlled operation.key values are passed to new JSONHeroPath(operation.key).set(newMetadata, value), without rejecting dangerous constructor and protot...

CVE-2026-72741 Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterpris...

CVE-2026-73616

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...

PT-2026-71764

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...