CVE-2026-55089

Etherpad (real-time collaborative editor) versions 2.1.0 through 3.1.0 contain a critical authorization bypass in the OAuth authorization_code path. The APIHandler.ts file checks only for the presence of the admin JWT claim rather than its boolean value, while OAuth2Provider.ts issues admin: fals...

CVE-2026-62670

CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...

CVE-2026-75951

J-BusinessDirectory extension (versions before 6.2.3) contains an Insecure Direct Object Reference flaw across multiple frontend/API actions, allowing unauthenticated remote attackers to access or modify other users' data; CVSS 6.9 (Medium). Remediation is to upgrade to version 6.2.3 or later. No...

CVE-2026-76211

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-75836 Grav API Plugin before 1.0.14 Missing Authorization

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

CVE-2026-74881

The PHP package openssl_encrypt (jahlives) before 1.4.0 sets CORS allow_origins to wildcard while allow_credentials is true, violating CORS spec. Attackers can lure authenticated users to malicious sites that issue authenticated cross-origin API requests, exposing data. No in-the-wild exploitatio...

CVE-2026-74800

SiYuan before v3.7.4 serves uploaded HTML files without Content-Disposition or X-Content-Type-Options headers, enabling authenticated attackers to inject stored XSS that runs with full kernel API access when the workspace owner clicks the asset link; upgrade to v3.7.4 or later. No active exploita...

EUVD-2026-60083

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...

EUVD-2026-58645

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

CVE-2026-73666

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

CVE-2026-57897

CVE-2026-57897 describes a Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs in Gitea. Connected sources confirm the issue affects Gitea’s org-level Actions Run/Job API surface, enabling information disclosure across repositories. The vulnerability’s exact root cause is not exh...

PT-2026-70357

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX CODE ONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'child...

CVE-2026-69116 FlyEnv < 4.18.0 Cross-Site Scripting via v-html

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem...

CVE-2026-17018

The CVE-2026-17018 affects the CubeWP Framework WordPress plugin up to version 1.1.30. The REST API endpoint does not perform per-object read authorization and does not restrict which metadata keys may be requested, enabling users with the Contributor role or higher to read arbitrary post metadat...

CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-67611

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...