CVE-2026-89032

BerriAI LiteLLM versions prior to 1.101.0-rc.1 are vulnerable to a tenant isolation bypass within the semantic cache layer . The flaw is caused by a metadata key mismatch between the _get_semantic_cache_tenant_scope() and _get_metadata_variable_name() functions. An authenticated remote attacker w...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the provideTrustedEmail process. An attacker can gain unauthorized access to user accounts, including administrator accounts, by leveraging Discord OAuth to associate an unverified email...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the reuse of a session identifier retained across successful authentication. An attacker can gain unauthorized access to an authenticated management session by exploiting the lack of HTTP session renewal after...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Java SDK ( CVE-2026-61308, CVE-2026-70907 & CVE-2026-60589)

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime.

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

EUVD-2026-87110

A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint...

CVE-2026-79005

A flaw was found in Google Chrome's StorageAccessAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to...

Chromium CVE-2026-95278: Missing authorization in WakeLock

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-100177

The AIL Framework crawler contains an authorization flaw in the api_add_crawler_task API. The application fails to validate organizational boundaries or user roles when a user provides a cookiejar UUID for one-shot or scheduled crawler tasks. Specifically, if a cookiejar's access level is not 0, ...

CVE-2026-84332

A flaw was found in Google Chrome. This incorrect authorization vulnerability in SiteSettings allows a remote attacker to bypass system access restrictions by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive system configurations...

CVE-2026-84331

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This could lead to unauthorized access to data or functionality acro...

BIT-OPENBAO-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

BIT-OPENBAO-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

CVE-2026-69148

A flaw was found in MLflow, an open-source AI engineering platform. Insufficient validation in the CreateModelVersion function allows an authenticated user to create a model version that references another user's artifact directory. This enables the authenticated user to read files from that...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898

The Akia keyless entry cloud service contained an Insecure Direct Object Reference (IDOR) vulnerability due to missing object-level authorization. The unlock action failed to validate client-supplied room or door identifiers against the authenticated guest's specific booking on the server-side. T...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-88848

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...