CVE-2026-90565

CVE-2026-90565 affects Rizwan17's inventory-management-system (a GitHub project using rolling release/continuous delivery, so no specific version boundaries are defined). The flaw resides in dashboard.php , where manipulation of the userid argument leads to improper access controls . The vulnerab...

CVE-2026-90598: Authorization Bypass Through User-Controlled Key

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypas...

PT-2026-90870

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

PT-2026-90979

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypas...

CVE-2026-90565: Improper Access Control

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

GHSA-65XW-2V52-JHXC n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

EUVD-2026-75189

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-87922

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-87922 Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-87922 Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

PT-2026-89170

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-86994

n8n , an open-source workflow automation platform, contained a missing userId filter that allowed cross-user information disclosure. The /rest/active-workflows endpoint returned every active workflow ID on the instance to any authenticated member regardless of sharing permissions, and lifecycle p...

CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-86262

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...

EUVD-2026-72239

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...

CVE-2026-86262 sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...

CVE-2026-86262

CVE-2026-86262 affects sfturing hosp_order (up to commit 627f426), an order-handling component in the file OrderController.java . The updateOrderdiseaseInfo function permits authorization bypass by manipulating the userID/id argument, allowing a remote, unauthenticated attacker to interfere with ...