CVE-2026-47724

Nebula-Mesh (pre-0.3.4) suffers an authorization gap: the /api/v1/* surface largely trusts bearer tokens and enforces ownership only for the Web layer, leaving host, network, firewall, mobile-bundle, and most operator endpoints vulnerable to cross-tenant access. This enables privilege escalation ...

CVE-2026-15630 CVE-2026-15630

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

EUVD-2026-48418

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-15630

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-63765

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...

EUVD-2026-48360

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...

CVE-2026-63765

CVE-2026-63765 affects Chatwoot

CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...

CVE-2026-65917

CyberPanel

CVE-2026-65916 CyberPanel Missing Authorization in cancelBackupCreation Handler

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

CVE-2026-65916

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

CVE-2026-65916

CyberPanel up to version 1.9.1 contains a missing authorization vulnerability in the cancelBackupCreation handler. An authenticated user can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt ba...

EUVD-2026-46431

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-63921

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface VTI module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect...

CVE-2026-63080

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-47697

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...

CVE-2026-63080

Aptabase (through commit 5a89368) contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. The attack can be carried out by supplying malic...

CVE-2026-63080 Aptabase SQL Injection via ClickHouse query backend

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-47697

Shelf is a multi-tenant platform for tracking physical assets. Prior to version 1.20.2, several endpoints accepted entity IDs from input and connected/read/updated them without verifying ownership, enabling cross-tenant IDOR where an authenticated user in Org A could access Org B’s data (assets, ...

CVE-2026-47413

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...