EUVD-2026-67811

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users...

CVE-2026-82280 Quivr Prompt Endpoints Missing Ownership Validation

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users...

CVE-2026-78203 Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

CVE-2026-18200

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

Session Hijacking

MCP Ruby SDK is vulnerable to Session Hijacking. The vulnerability is due to missing session ownership validation in StreamableHTTPTransport, allowing attackers with a stolen session ID to execute tool calls within the victim's session...

EUVD-2026-50271

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

EUVD-2026-49698

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...

EUVD-2026-49632

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

PT-2026-65305

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the DeleteNotificationController::delete method at the GET /notification/delete/id endpoint. This flaw allows any authenticated us...

CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

EUVD-2026-49044

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

CVE-2026-66013

OpenRemote has a vulnerability (CVE-2026-66013) affecting versions before 1.26.2 where the console registration API is vulnerable to authentication bypass. This allows unauthenticated attackers to update existing console assets by supplying a known asset identifier, enabling them to overwrite pus...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through improper validation of ownership in the editRecord process. An attacker can modify or overwrite DNS records in zones they do not own by manipulating the rid and zid parameters in ...

CVE-2026-14172

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...

PT-2026-64243

Name of the Vulnerable Software and Affected Versions Rapid7 InsightVM affected versions not specified Nexpose affected versions not specified Rapid7 Insight Agent versions prior to 0.0.245.0 Rapid7 Scan Engine versions prior to 1.1.3935 Description Rapid7 InsightVM, Nexpose, and the Insight Agen...

GHSA-6C6R-5XR4-CR5M Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

CVE-2026-44585

CVE-2026-44585 affects Paymenter prior to v1.5.0. The ticket creation endpoint validates ownership of a user-supplied service identifier is not enforced, enabling an authenticated user to create tickets that reference another user’s service. Impact stated: no direct access to service contents or ...

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...