PT-2026-118458

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms...

PT-2026-118492

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...

PT-2026-118501

Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5 Description The form submission endpoint '/api/v1/@apostrophecms/form/submit' processes unbounded multipart uploads using the multer function before performing authentication, API-key verification, or...

PT-2026-118420

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions 1.3.0.Final through 1.3.1.Final Description The AndroidA2AHttpClient synchronous POST path incorrectly overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with a default followRedirects value ...

PT-2026-118472

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

PT-2026-120295

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

Oracle MySQL Vulnerability CVE-2026-101726

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

PT-2026-118244

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact ma...

PT-2026-118466

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions 3.0.0 through 3.2.0 Description An authorization bypass allows authenticated users to access files stored by other users by directing a processing folder toward the server storage directory. An attacker can utilize the...

PT-2026-119043

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

PT-2026-120309

Summary The REST route GET /api/v1//: id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...

PT-2026-118588

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description The self-service password-change endpoint verifies the current password but fails to utilize the login module's failed-attempt counter, throttle, delay, or lockout mechanisms. An attacker with...

PT-2026-118338

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

Oracle MySQL Vulnerability CVE-2026-101725

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: C API. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

PT-2026-118298

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

Red Hat: CVE-2026-92539: grafana: Grafana: Unauthorized cross-organization user management via the SCIM API

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

PT-2026-117952

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import 'subprocess' to run commands, stealing environment...

PT-2026-118585

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permissionfalse in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated...

PT-2026-118459

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...

PT-2026-118482

Name of the Vulnerable Software and Affected Versions SuggestArr versions prior to 3.0.0 Description An authentication bypass exists in the local bypass authentication mode. The enforce authentication function in api service/auth/middleware.py trusts the request.remote addr value, which is derive...