CVE-2026-55146 LORIS has incorrect access checks in issue_tracker

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the issuetracker backend does not correctly verify edit access...

CVE-2026-55146

The LORIS (Longitudinal Online Research and Imaging System) web application contains an incorrect access check in its issue_tracker backend. Specifically, in versions 16.0.0 to 27.0.3 and 28.0.0 to 28.0.1 , the backend fails to verify edit permissions even though the frontend restricts them. This...

CVE-2026-55146 LORIS has incorrect access checks in issue_tracker

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the issuetracker backend does not correctly verify edit access...

CVE-2026-55147 LORIS has incorrect access checks in API for Imaging Browser

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the API for the imagingbrowser module permits edits to imaging data...

CVE-2026-55147 LORIS has incorrect access checks in API for Imaging Browser

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the API for the imagingbrowser module permits edits to imaging data...

CVE-2026-55147

The LORIS (Longitudinal Online Research and Imaging System) web application contains a security flaw where the API for the imaging_browser module fails to verify frontend permissions. This missing authorization allows an authenticated API caller to modify imaging data without the necessary privil...

CVE-2026-55147 LORIS has incorrect access checks in API for Imaging Browser

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the API for the imagingbrowser module permits edits to imaging data...

TYPO3 CMS Permission Authorization and Access Control Vulnerabilities

The TYPO3 CMS versions from 14.0.0 to 14.3.8 have security vulnerabilities. These vulnerabilities arise from using the FileUpload or ImageUpload elements in forms that configure a custom saveToFileMount setting. As a result, uploaded files are stored in the default storage folder 1:/userupload/,...

GHSA-9G87-32V6-3C2R Payload: Sort queries could expose protected field information

Impact Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read. You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields. Patches Payload now applies field-level...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2026_27812)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202627812 advisory. kernel: selinux: fix overlayfs mmap and mprotect access checks CVE-2026-46054 Tenable has extracted the preceding description block directly from the CIQ security...

CVE-2026-101092

SiYuan versions before v3.8.4 are vulnerable to an information disclosure flaw in the getCurrentAttrViewImages endpoint. The root cause is a failure to enforce publish-access checks , which allows users with publish reader permissions to retrieve image asset paths and filenames from unauthorized ...

PT-2026-102388

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient publish-access checks in the 'getCurrentAttrViewImages' endpoint allow users with publish reader permissions to retrieve image asset paths from unauthorized databases. By providing an...

SUSE CVE-2026-72805

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

PT-2026-82300

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

EUVD-2026-64328

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.3 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

EUVD-2026-64321

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

CVE-2026-76600 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

CVE-2026-76601

Fabrik is a Joomla extension developed by fabrikar.com. In versions prior to 4.7.2 , the order plugin did not perform any access checks, allowing unauthenticated row reordering of data. An attacker can exploit this over the network without credentials or user interaction to alter the ordering of ...

CVE-2026-76601 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...