CVE-2026-111688 Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-111688

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

EUVD-2026-102602

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

CVE-2026-111445

The Wheels framework versions 4.0.0 through 4.1.2 (before 4.2.0 ) is vulnerable to a flaw where incoming scope conditions are replaced with a primary-key condition in findByKey() and exists(key=) . Specifically, in exists(key=) , if production error information is disabled, the system may return ...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111688: Incorrect Authorization

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-111449: Concurrent Execution using Shared Resource with Improper Synchronization

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true disabled by default. An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that...

PT-2026-115408

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

PT-2026-116087

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

Astra Linux – vulnerability in nasm

A stack-use-after-scope issue found in the expandmmacparams function within preproc.c in nasm prior to version 2.15.04 enables remote attackers to trigger a denial of service by using a specially crafted asm file...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: do not set up encryption key during jbd2 transaction Commit a80f7fcf1867 “ext4: fixup ext4fctrack functions’ signature” Extended the scope of the transaction in ext4unlink too far, causing it to include calls to...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: SCTP: The initialization of additional fields in sctpv6fromsk was incorrect, leading to undefined behavior. SYZbot discovered that sin6scopeid was not properly initialized, causing undefined behavior. sin6scopeid and...

CVE-2026-46691

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-46691 EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...

CVE-2026-46691

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/id/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that impor...