EUVD-2026-70492

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

EUVD-2026-70490

CRMEB contains an authentication bypass vulnerability in the verifyAuth method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits...

CVE-2026-85212 CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check

CRMEB contains an authentication bypass vulnerability in the verifyAuth method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits...

CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

EUVD-2026-70485

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-85181

CAT (dianping/cat) through 3.1.0 is vulnerable to session cookie forgery due to using Java String.hashCode as the sole integrity check without a server-side secret key. An attacker can compute valid checksums offline and, by setting the x-forwarded-for header, bypass IP-binding validation to crea...

CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-80515

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

CVE-2026-80515

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

CVE-2026-80515

Eclipse Arrowhead versions 5.0.0 through 5.2.1 are affected by an authorization-bypass vulnerability in the management REST endpoints. The root cause is a mismatch between Tomcat's undecoded getRequestURL() and Spring MVC's decoded routing: the management-authorization gate checks for the literal...

DEBIAN-CVE-2026-76178

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

CVE-2026-76178

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

UBUNTU-CVE-2026-76178

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

CVE-2026-15933

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

CVE-2025-12737

CVE-2025-12737 affects WSO2 products via the Carbon Console . Administrative operations within the console do not adequately validate specific user-supplied input, allowing a threat actor with administrative privileges to inject and execute arbitrary code remotely , leading to complete compromise...

CVE-2026-85174

SiYuan before v3.8.2 is vulnerable to API token exposure via its log file. When full-text search requests exceed timing thresholds, API tokens passed in query parameters are written in plaintext to an accessible log file. An authenticated attacker can retrieve the log file through the getFile end...

CVE-2026-85174 SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...