EUVD-2026-107246

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114395

Trudesk versions through 1.2.11 are vulnerable to an authorization bypass in the apiMessages.send function. This issue stems from an incomplete fix for CVE-2022-1931, allowing authenticated users to supply arbitrary owner and cId values via a POST request to /api/v1/messages/send. Consequently, a...

CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114396 Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or...

EUVD-2026-107242

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114395 Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114396 Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or...

CVE-2026-114396

Trudesk through version 1.2.11 is vulnerable to a server-side JavaScript injection via the tickets search API. Authenticated users can inject code into a MongoDB $where clause through the search parameter in a GET request to /api/v1/tickets/search. By closing the regular expression, an attacker c...

CVE-2026-114393 Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

CVE-2026-114393

Trudesk versions up to 1.2.11 are susceptible to an authorization bypass vulnerability (CWE-639) affecting the Ticket Update API Endpoints . The root cause is that the application only verifies the default tickets:update role grant, allowing any authenticated user to modify tickets outside of the...

CVE-2026-114393 Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

EUVD-2026-107240

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

CVE-2026-114392 Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...

EUVD-2026-107239

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...

CVE-2026-114392 Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...

CVE-2026-114392

Trudesk versions through 1.2.11 are susceptible to an authorization bypass vulnerability within the apiTickets.single handler. The root cause is that the handler skips group membership checks , allowing authenticated users to access tickets outside of their assigned groups via the GET /api/v1/tic...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to failure to validate the API key's declared location and prevent credential-bearing custom headers from being forwarded across cross-origin redirects, which allows a malicious or compromised remote agent t...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to improper redirect handling in the Android HTTP client's synchronous POST requests, which allows an attacker controlling a redirected destination to obtain configured API keys or authentication tokens...

CVE-2026-59229

Apache IoTDB (versions 2.0.0 before 2.0.11) is vulnerable to a privilege escalation issue in the Legacy Pipe receiver protocol (handshake / sendPipeData). The vulnerability arises because the protocol uses a hardcoded SUPER_USER (root) identity to execute data loading and deletion operations. Con...