CVE-2026-111692: Use of Hard-coded Cryptographic Key

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

CVE-2026-111630: Authorization Bypass Through User-Controlled Key

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

CVE-2026-111708: Improper Privilege Management

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

PT-2026-116103

🚨 CVE-2026-111704 LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM...

PT-2026-116073

🚨 CVE-2026-111674 Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrit...

PT-2026-116054

🚨 CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POS...

PT-2026-115649

Name of the Vulnerable Software and Affected Versions SparkyFitness versions prior to 1.6.0 Description The 'api/admin/backup/restore' endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a filename containing she...

PT-2026-116091

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

PT-2026-116089

Name of the Vulnerable Software and Affected Versions Simple Admin Core versions prior to 1.8.8 Description An authentication bypass exists due to a hard-coded Auth.AccessSecret located in the api/etc/core.yaml file. This allows unauthenticated remote attackers to forge JSON Web Tokens JWT by...

CVE-2026-111365

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with...

CVE-2026-111366

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user: permissions can call /admin/sys/user/info, update, or delete to read records,...

CVE-2026-111352

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111347

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111330

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111329

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111365

The cool-admin-midway software (through version 8.0.0 ) is vulnerable to an authorization bypass (CWE-639) in its system role endpoints. Attackers with ordinary sys:role permissions can provide arbitrary role IDs to call the /admin/sys/role/info , update , or delete endpoints. This allows them to...

CVE-2026-111365 cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with...

CVE-2026-111366 cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user: permissions can call /admin/sys/user/info, update, or delete to read records,...

CVE-2026-111366

The cool-admin-midway application, through version 8.0.0 , is vulnerable to an authorization bypass (CWE-639) within the /admin/sys/user endpoints. This flaw allows department-limited administrators to manage users outside of their assigned departments by providing arbitrary user IDs . Attackers ...

CVE-2026-111352

ThinkCMF versions through 8.0.1 are vulnerable to an incorrect authorization flaw in the RestAdminBaseController. The root cause is that Auth::check() fails open when no admin_api rule is defined, allowing restricted backend administrators to access all admin REST API endpoints. An attacker posse...