CVE-2026-112292

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

PT-2026-117436

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal server token values and alert...

CVE-2026-42884: Incorrect Authorization

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collections and GET /api/collections/:id endpoints return collections from all libraries without checking whether the requesting user has access to each collection's library. An authenticated user with...

PT-2026-39749

Name of the Vulnerable Software and Affected Versions Audiobookshelf versions prior to 2.32.2 Description An authenticated user with access to any library can enumerate and read collections, including full book metadata, from libraries they are explicitly restricted from accessing. This occurs...