PT-2026-110105

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

PT-2026-110131

Name of the Vulnerable Software and Affected Versions Flyte versions 2.0.1 through 2.0.51 Description An issue exists where secrets are stored in cleartext, allowing users with Pod read access to obtain sensitive information by reading init container environment variables. The embedded secret...

PT-2026-110060

Name of the Vulnerable Software and Affected Versions ASPL Product Quotation versions prior to 1.1.1 Description An issue exists where the software fails to sanitize and escape the quote id parameter before incorporating it into SQL statements. This allows unauthenticated attackers to execute SQL...

PT-2026-110113

Name of the Vulnerable Software and Affected Versions NornicDB versions prior to 1.4.2 Description Authenticated users can bypass per-database read restrictions. Users with a viewer role who are allowlisted for a database but denied read access can retrieve node IDs, labels, and full property map...

PT-2026-110161

Name of the Vulnerable Software and Affected Versions mistral.rs versions 0.9.0 through 0.9.4 Description A link following issue exists in the mistralrs-code-exec component. This allows sandboxed shell code to read and overwrite files outside the sandbox by using symlinks symbolic links, which ar...

PT-2026-110137

Name of the Vulnerable Software and Affected Versions Frappe CRM versions 1.49.0 through 1.87.0 Description An issue exists where authenticated users can read linked documents without proper permission checks. By specifying a lead, deal, comment, or user they are not authorized to access, an...

PT-2026-110055

Name of the Vulnerable Software and Affected Versions WpCues Basic Quiz versions prior to 1.6.6 Description The plugin fails to properly sanitize and escape values before incorporating them into a SQL statement. This allows unauthenticated attackers to execute SQL injection attacks, which is a...

PT-2026-110147

Name of the Vulnerable Software and Affected Versions CloudBeaver versions prior to 25.3.6 Description A missing authorization issue exists in the WebSQLResultServlet endpoint. This allows any user with a valid web session to access LOB Large Object export files belonging to other users stored in...

PT-2026-110170

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.11 Description An authorization flaw exists in the MCP server faq search tool. This occurs because the searchDatabase function fails to apply user or group permission checks. Consequently, clients connected to th...

PT-2026-109988

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.19.1 Description Authenticated users can read server files because the src/converters/pandoc.ts file invokes Pandoc without the --sandbox flag. An attacker can exploit this by uploading a reStructuredText document...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

mod_auth_openidc security update

2.4.16.11-1.1 - Resolves: RHEL-248048 - CVE-2026-54789 out-of-bounds read/write in oidcstatecookiescleanexpired when a state-prefixed cookie token contains no '=' separator...

CVE-2026-108672

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video...

CVE-2026-108669

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to...

CVE-2026-108654

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-108640

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes,...

CVE-2026-108674

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain interna...

CVE-2026-108674

JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the OpenApiController queryById handler. This flaw allows low-privileged authenticated users to access OpenAPI definitions without the required permissions. By sending a GET request to /openapi/queryById wit...

CVE-2026-108672

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video...

CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to...