PT-2026-110105

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

CVE-2026-108573: Out-of-bounds Read

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

CVE-2026-108851: Missing Authorization

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

PT-2026-110131

Name of the Vulnerable Software and Affected Versions Flyte versions 2.0.1 through 2.0.51 Description An issue exists where secrets are stored in cleartext, allowing users with Pod read access to obtain sensitive information by reading init container environment variables. The embedded secret...

PT-2026-110188

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can read permissions for any account due to missing authorization in the queryUserAuths handler. Low-privileged attackers can provide an arbitrary userId parameter to retrieve t...

PT-2026-110060

Name of the Vulnerable Software and Affected Versions ASPL Product Quotation versions prior to 1.1.1 Description An issue exists where the software fails to sanitize and escape the quote id parameter before incorporating it into SQL statements. This allows unauthenticated attackers to execute SQL...

PT-2026-110113

Name of the Vulnerable Software and Affected Versions NornicDB versions prior to 1.4.2 Description Authenticated users can bypass per-database read restrictions. Users with a viewer role who are allowlisted for a database but denied read access can retrieve node IDs, labels, and full property map...

PT-2026-110161

Name of the Vulnerable Software and Affected Versions mistral.rs versions 0.9.0 through 0.9.4 Description A link following issue exists in the mistralrs-code-exec component. This allows sandboxed shell code to read and overwrite files outside the sandbox by using symlinks symbolic links, which ar...

PT-2026-110137

Name of the Vulnerable Software and Affected Versions Frappe CRM versions 1.49.0 through 1.87.0 Description An issue exists where authenticated users can read linked documents without proper permission checks. By specifying a lead, deal, comment, or user they are not authorized to access, an...

PT-2026-110055

Name of the Vulnerable Software and Affected Versions WpCues Basic Quiz versions prior to 1.6.6 Description The plugin fails to properly sanitize and escape values before incorporating them into a SQL statement. This allows unauthenticated attackers to execute SQL injection attacks, which is a...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

PT-2026-110147

Name of the Vulnerable Software and Affected Versions CloudBeaver versions prior to 25.3.6 Description A missing authorization issue exists in the WebSQLResultServlet endpoint. This allows any user with a valid web session to access LOB Large Object export files belonging to other users stored in...

PT-2026-110170

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.11 Description An authorization flaw exists in the MCP server faq search tool. This occurs because the searchDatabase function fails to apply user or group permission checks. Consequently, clients connected to th...

PT-2026-109988

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.19.1 Description Authenticated users can read server files because the src/converters/pandoc.ts file invokes Pandoc without the --sandbox flag. An attacker can exploit this by uploading a reStructuredText document...

CVE-2026-108694: External Control of File Name or Path

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

CVE-2026-108867: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...

CVE-2026-108710: Missing Authorization

NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node ID...

CVE-2026-108878: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and...

mod_auth_openidc security update

2.4.16.11-1.1 - Resolves: RHEL-248048 - CVE-2026-54789 out-of-bounds read/write in oidcstatecookiescleanexpired when a state-prefixed cookie token contains no '=' separator...

CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...