CVE-2026-82281 Kotaemon Missing Ownership Check in Conversation Functions

Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...

CVE-2026-82280

Quivr through 0.0.322 fails to validate ownership in its prompt endpoints, allowing any authenticated user to modify prompts by identifier. An attacker with only read-only access to a shared brain can discover exposed prompt identifiers and overwrite system prompts , affecting all users of that b...

EUVD-2026-67810

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

CVE-2026-82279

HyperDX through version 1.10.1 fails to enforce role-based access control on team management endpoints, allowing any authenticated team member (low privileges) to perform administrative actions. Specifically, requests to PATCH /team/apiKey , PATCH /team/name , and DELETE /team/member can be used ...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272

Immich versions up to 3.1.0 contain a visibility enforcement flaw: when an asset is locked via the single-asset endpoint , the lock is not correctly applied to shared albums and shared links , allowing a low-privileged attacker to read the asset and its metadata without bypassing any other protec...

EUVD-2026-67802

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...

EUVD-2026-67803

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-81761

Subscriber Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81759

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81767

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-81578

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854

A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. This oversight could allow a remote attacker to bypass intended network-based access control...

CVE-2026-31282

CVE-2026-31282 Descrizione Totara LMS è vulnerabile a un controllo degli accessi errato. Il codice della pagina di login può essere manipolato per rivelare il modulo di login e bypassare l'accesso Octa. Un attaccante può combinare questo con la mancanza di rate-limit sul modulo di login per...

rbac

PHP-RBAC v2.x PHP-RBAC è una libreria di autorizzazione per PHP. Fornisce agli sviluppatori il controllo degli accessi basato sui ruoli RBAC gerarchico di Livello 2 NIST e altro, nell'implementazione più veloce finora. Versione stabile attuale: PHP-RBAC v2.0 Contattaci Pagina principale:...

CVE-2026-25049

🚨 CVE-2026-25049 – Divulgazione non autenticata delle impostazioni di n8n 📌 Panoramica CVE ID: CVE-2026-25049 Software interessato: n8n Gravità: Critica Categoria: Controllo degli accessi improprio / Divulgazione di informazioni Questa vulnerabilità consente l'accesso non autenticato ai dati di...

CVE-2026-21962

🚨 CVE-2026-21962 - Vulnerabilità critica di bypass dell'autenticazione 🧾 Riepilogo 🔥 Una vulnerabilità di gravità massima 10.0 che consente accesso remoto non autenticato ai sistemi middleware Oracle. root@kitploit: CVE ID : CVE-2026-21962 Severity : CRITICAL Published : 2026-01-20 Category :...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution टूटा हुआ एक्सेस नियंत्रण WordPress प्लगइन Eventin 10,000+ सक्रिय स्थापनाएँ में अप्रमाणित PII प्रकटीकरण और आदेश जालसाजी । एक सार्वजनिक REST एंडपॉइंट किसी भी विज़िटर को wprest nonce देता है, और तीन डाउनस्ट्रीम अनुमति कॉलबैक उस nonce को प्रमाणीकरण के विकल्प क...