PT-2026-118056

Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

PT-2026-117436

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal server token values and alert...

PT-2026-117630

Name of the Vulnerable Software and Affected Versions Grav API plugin grav-plugin-api versions 1.0.16 through 1.0.41 Description The plugin contains two distinct issues. First, the unauthenticated GET '/api/v1/translations/lang' endpoint caches a full translation dictionary for every well-formed...

PT-2026-117692

Name of the Vulnerable Software and Affected Versions H3C Magic NX15 version NX15V100R017 Description A remote code injection issue exists within the RPC Interface component. The problem occurs in the write function of the '/api/esps' endpoint, where manipulating the path argument allows an...

CVE-2026-112291: Missing Authorization

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

CVE-2026-112292: Missing Authorization

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/ /records endpoints to steal servertoken values and...

CVE-2026-112188: Exposure of Sensitive Information to an Unauthorized Actor

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...

PT-2026-118000

Summary A missing comma in mercury app/block handler.py's BLOCKED PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury...

CVE-2026-112363: Server-Side Request Forgery (SSRF)

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

PT-2026-118091

Arcane: Environment access token bypasses the admin-required authorization gate on /api/debug/pprof in github.com/getarcaneapp/arcane/backend...

CVE-2026-109434: User Interface (UI) Misrepresentation of Critical Information

Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attacker...

CVE-2026-111862: Embedded Malicious Code

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a...

CVE-2026-112074: Integer Overflow or Wraparound

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/matpixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched...

PT-2026-117459

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage settings checks. A low-privileged staff account with...

CVE-2026-111056: Exposure of Sensitive Information to an Unauthorized Actor

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...

CVE-2026-112779: Allocation of Resources Without Limits or Throttling

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

CVE-2026-111046: Missing Authorization

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with...

CVE-2026-112097: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactionshandler.php?action=savesale of the component Sales Management Handler. The manipulation of the argument HsnCode results in cross site scripting. It is possible...

PT-2026-117310

Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Use...

PT-2026-118055

Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...