CVE-2026-86766 Snipe-IT 8.6.3 Race Condition via Consumable Checkout

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...

CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

EUVD-2026-74941

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86764

Snipe-IT through 8.6.4 (fixed in 8.7.0 ) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components . The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is a...

CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

EUVD-2026-74789

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

CVE-2026-86777

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to enforce authorization on the GET /api/nodes endpoint. This allows unauthenticated attackers to retrieve all navigation nodes, disclosing restricted page names, URL paths, and internal URLs across all sites and languages. The vulnerabi...

CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

PT-2026-89027

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

EUVD-2026-74285

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

EUVD-2026-57450

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo...

CVE-2026-81531

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

CVE-2026-81531

CVE-2026-81531 affects Omada Controller (multiple versions, per the CNA title). An API endpoint intended for Controller initialization remains accessible after the initialization process completes, allowing unauthenticated remote users to query it and obtain account-related information . Successf...

EUVD-2026-72556

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...

PT-2026-87186

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...