CVE-2026-46407 Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's adminid. This can...

CVE-2026-46407 Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's adminid. This can...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: GHSA-GQX7-6552-67HF...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: OSV:GHSA-GQX7-6552-67HF...

com.oviva.telematik:epa4all-rest-service (0.0.5) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.5)

com.oviva.telematik:epa4all-client MAVEN version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.5 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.7) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.7)

com.oviva.telematik:epa4all-client MAVEN version 0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.7 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17277595...

com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1), com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) +1 more potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-vau-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-vau-client MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45575 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17277596...

com.oviva.telematik:epa4all-rest-service (0.0.4) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.4)

com.oviva.telematik:epa4all-client MAVEN version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.4 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.8) potentially affected by CVE-2026-45575 via com.oviva.telematik:epa4all-client (0.0.8)

com.oviva.telematik:epa4all-client MAVEN version 0.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.8 Source cves: CVE-2026-45575 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.5) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.5)

com.oviva.telematik:epa4all-client MAVEN version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.5 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45574 Source advisory: OSV:GHSA-5HHF-XMFX-4VVR...

com.oviva.telematik:epa4all-rest-service (0.0.7) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.7)

com.oviva.telematik:epa4all-client MAVEN version 0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.7 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.8) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.8)

com.oviva.telematik:epa4all-client MAVEN version 0.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.8 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (0.0.4) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (0.0.4)

com.oviva.telematik:epa4all-client MAVEN version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.4 Source cves: CVE-2026-45574 Source advisory:...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45574 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17326433...

com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.1) potentially affected by CVE-2026-45574 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.1)

com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.1 Source cves: CVE-2026-45574 Source advisory: GHSA-5HHF-XMFX-4VVR...

Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

Summary The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services cloud metadata, databases by redirecting through an attacker-controlled server. The same vulnerability class was already patched in...

CVE-2026-44774

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider...

CVE-2026-44774

CVE-2026-44774 - Traefik Gateway API exposure vulnerability Affected: Traefik v2.x before 2.11.46, v3.x before 3.6.17 and 3.7.1. Issue: In the Kubernetes Gateway API provider, a tenant with HTTPRoute creation rights can expose the REST provider handler by abusing TraefikService backend references...