CVE-2026-76806

The open-source time-tracking application Solidtime (prior to version 0.16.0 ) is vulnerable to a Path Traversal flaw in its TogglDataImporter::importData() function. The vulnerability exists because the importer reads attacker-controlled project ID values from projects.json within uploaded ZIP f...

EUVD-2026-114443

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735...

CVE-2026-121936

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...

EUVD-2026-116893

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...

Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution

Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.importmodule on user-supplied import statements, executing module top-level code instead of merely validating syntax. Combined with the defau...

EUVD-2026-116580

A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/id/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possibl...

PT-2026-136956

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...

CVE-2026-121562

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when...

EUVD-2026-115907

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when...

CVE-2026-121562 CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when...

CVE-2026-121562

The CTFd platform versions 3.1.0 before 3.8.7 is vulnerable to an information disclosure flaw within the /api/v1/teams list endpoint. The root cause is an incorrect authorization (CWE-863) that fails to protect non-public team custom field values. Unauthenticated attackers can exploit this by sen...

CVE-2026-121560 LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

CVE-2026-121560

LogChimp versions 0.9.0-alpha.1 before 0.9.3 are vulnerable to an authorization bypass via the PATCH /api/v1/posts endpoint. The root cause is the handling of mismatched postId and id body parameters; an authenticated author can set postId to their own post while providing an enumerated victim po...

CVE-2026-89295

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/count and GET /api/v2/IdGenerator/submodelIds/count endpoints is not enforced. The service generates and retains...

EUVD-2026-115818

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/count and GET /api/v2/IdGenerator/submodelIds/count endpoints is not enforced. The service generates and retains...

CVE-2026-89295

The Eclipse Mnestix AAS Generator (versions 0.1.0 through 1.4.x ) is vulnerable to an unauthenticated memory-exhaustion denial of service (DoS). The root cause is the lack of a practical upper bound on the client-supplied count parameter in the GET /api/v1/IdGenerator/submodelIds/{count} and GET ...

CVE-2026-89295 Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter

In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/count and GET /api/v2/IdGenerator/submodelIds/count endpoints is not enforced. The service generates and retains...

CVE-2026-121562: CTFd: CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that…

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when...

CVE-2026-109141

The vulnerability gives a role that is restricted to a list of CAs cas = ... its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resource...

CVE-2026-109141

The Krill software is affected by a vulnerability where a role restricted to a specific list of CAs can gain full permissions for requests not tied to a CA. Specifically, this affects the bulk import endpoint POST /api/v1/bulk/cas/import, allowing an attacker to add a new child CA under any exist...