CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55176

In Soft Machine versions 0.2.247 and prior , an authentication bypass exists in the /app/server.js file. The helper functions verifyContainerAuth() and authenticateWorkspaceHttp() incorrectly accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying workspace ownership. Since ...

CVE-2026-55176 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-46711

In Soft Machine versions 0.2.247 and prior , the workspace HTTP service listening on 0.0.0.0:8080 within sm-ws- Fly Machines * lacks authentication and origin checks. This vulnerability allows any host capable of reaching TCP/8080 to access endpoints such as /health, /file/, and /archive/. Conseq...

EUVD-2026-90083

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177

CloudTAK is vulnerable to a full-read Server-Side Request Forgery (SSRF) in the ESRI helper family routes (e.g., POST /api/esri) prior to version 13.10.0 . The root cause is a lack of IP/DNS/hostname classification; the api/lib/esri.ts library uses a bare fetch on attacker-controlled URLs without...

CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504 , could allow a remote attacker with no login access to use the Manager's API...

CVE-2026-76570

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request...

CVE-2026-103270

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding CWE-177. An...

SUSE CVE-2026-103111

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

CVE-2026-103396

bbs-go through version 4.4.6 is vulnerable to a permission bypass within the AdminMiddleware authorization logic. The root cause is that the dashboard.user.view permission rule incorrectly matches the /api/admin/user/synccount endpoint before the required dashboard.user.update rule is evaluated. ...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

EUVD-2026-89989

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...