EUVD-2026-96728

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...

CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108707: Improper Authentication

WukongHRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal dat...

PT-2026-110000

Name of the Vulnerable Software and Affected Versions Studio-Saelix Sencho versions prior to 0.97.1 Description An issue exists in the Add Remote Node API Endpoint component within the isValidRemoteUrl function of the backend/src/utils/validation.ts file. An authenticated user with node-managemen...

PT-2026-110003

Name of the Vulnerable Software and Affected Versions Studio-Saelix Sencho versions prior to 0.94.1 Description A remote server-side request forgery SSRF exists within the git-sources Browse API Endpoint, specifically affecting the outboundTarget.ts file. This issue occurs when the repo url...

CVE-2026-108521: Server-Side Request Forgery (SSRF)

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108523: Server-Side Request Forgery (SSRF)

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be...

CVE-2026-6723

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by...

CVE-2026-6723: Incorrect Authorization

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-85423

A vulnerability exists in the data collection service of Brocade ASCG versions prior to 3.5.0 . An API endpoint within the data collector service lacks proper authentication or authorization checks for incoming requests. An attacker with network access can exploit this to instruct the application...

PT-2026-107854

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-76271

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...

CVE-2026-107102

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2026-107103

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

EUVD-2026-94218

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...