CVE-2026-6355

Augmentt: Cross-Tenant Access via IDOR Credits This CVE was a collaborative effort between: Raznov – GitHub: https://github.com/basraznov HelloWorld Author– GitHub: https://github.com/Penquinsecq Description A vulnerability in the web application allows unauthorized users to access and manipulate...

CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak Overview Apache Camel's KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This means a token issued by one Keycloak realm is silently accepted by a policy configured for a...

CVE-2026-66076

The RabbitMQ messaging and streaming broker is vulnerable to a cross-vhost information disclosure issue in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 . The root cause is that the is_authorized/2 function calls rabbit_mgmt_util:is_authorized/2, which incorrectly checks only the ma...

CVE-2026-84680

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a Galaxy or Automation Hub credential to an organization through the galaxycredentials relationship endpoint, the controller verifies only that the requesting user can read the credential, rather than...

CVE-2026-71459 Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

CVE-2026-85724

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

CVE-2026-85724

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

CVE-2026-48975

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

EUVD-2026-84033

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/reponotifier.go updates a notifier through UpdateOneIDid without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another...

CVE-2026-48976

Prior to version 0.26.0 , HomeBox (a home inventory and organization system) is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the NotifierRepository.Update function located at backend/internal/data/repo/repo_notifier.go. The application fails to verify if the record's us...

CVE-2026-88978

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durableevents.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant...

CVE-2026-88978

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows. Prior to 0.106.1 , the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter ....

UBUNTU-CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-77240

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profilesupdate row-level security policy in supabase/migrations/017accountsharing.sql permits authenticated users to modify their own accountrole and accountid, allowing a viewer to self-promote or move into...

CVE-2026-77240 WACRM: Database-layer authorization bypasses

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profilesupdate row-level security policy in supabase/migrations/017accountsharing.sql permits authenticated users to modify their own accountrole and accountid, allowing a viewer to self-promote or move into...

EUVD-2026-81019

Tina: Broken Access Control letting any TinaCloud user authorize against any self-hosted site...

CVE-2026-92782

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests...

CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...