EUVD-2026-75445

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...

PT-2026-89616

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...

CVE-2026-52098

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint...

EUVD-2026-75621

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint...

CVE-2026-75308

yshopmall =3.3 is vulnerable to Cross Site Scripting XSS. The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files...

CVE-2026-86764

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86758

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

CVE-2026-86769 Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission...

CVE-2026-86766 Snipe-IT 8.6.3 Race Condition via Consumable Checkout

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...

CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

EUVD-2026-74941

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86764

Snipe-IT through 8.6.4 (fixed in 8.7.0 ) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components . The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is a...

CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

EUVD-2026-74789

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

CVE-2026-86777

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to enforce authorization on the GET /api/nodes endpoint. This allows unauthenticated attackers to retrieve all navigation nodes, disclosing restricted page names, URL paths, and internal URLs across all sites and languages. The vulnerabi...

CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

PT-2026-89027

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

EUVD-2026-74285

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...