CVE-2026-100361

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at...

CVE-2026-100361

The SuiteCRM Customer Relationship Management application (versions prior to 7.15.2 and 8.10.2 ) is vulnerable to a mass assignment flaw in the V8 API write path. Specifically, the PATCH /Api/V8/module endpoint fails to enforce api-visible or sensitive metadata constraints. This allows an authent...

CVE-2026-100361 SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at...

CVE-2026-121560 LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

CVE-2026-121560

LogChimp versions 0.9.0-alpha.1 before 0.9.3 are vulnerable to an authorization bypass via the PATCH /api/v1/posts endpoint. The root cause is the handling of mismatched postId and id body parameters; an authenticated author can set postId to their own post while providing an enumerated victim po...

CVE-2026-121560 LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713

Paperclip versions 2026.403.0 before 2026.416.0 are vulnerable to Remote Code Execution (RCE) due to an OS Command Injection flaw (CWE-78). Agent API key holders can utilize the PATCH /api/execution-workspaces/:id endpoint to set arbitrary cleanupCommand and teardownCommand values. When a workspa...

EUVD-2026-114118

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713: paperclipai @paperclipai/server: Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders…

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

Paperclip command injection vulnerability

Versions prior to Paperclip 2026.416.0, specifically 2026.403.0, contain a command injection vulnerability. This vulnerability arises because attackers possessing an agent API key can set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. Upon archiving the workspace, the...

CVE-2026-89419

A flaw was found in OpenStack Ironic. A missing authorization check in the node PATCH API allows an authenticated lessee member to change the maintenance state of a bare metal node, an operation that should be restricted to lessee managers and administrators. By sending a PATCH request to...

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

PT-2026-118500

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because th...

PT-2026-120300

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

PT-2026-118588

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description The self-service password-change endpoint verifies the current password but fails to utilize the login module's failed-attempt counter, throttle, delay, or lockout mechanisms. An attacker with...