CVE-2026-110035: Improper Access Control

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from...

CVE-2026-112014: Use of Hard-coded Cryptographic Key

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

CVE-2026-112001: Incorrect Authorization

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-97859: Missing Authorization

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

PT-2026-128619

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls api: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's tcf chain tp dele...

VulnCheck KEV: CVE-2026-33309

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 External Control of File Name, leading to the root architectural issue within LocalStorageService remaining unresolved. Because the underlying...

PT-2026-116535

Name of the Vulnerable Software and Affected Versions makeplane plane versions prior to 1.4.3 Description An issue exists within the API Endpoint component where the system relies on untrusted inputs when making security decisions. A remote attacker can exploit this by manipulating the...

PT-2026-117157

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.3 Gitea versions prior to 28.0.0 Description Seven API endpoints under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys, and gpg keys were registered without the...

PT-2026-116618

Name of the Vulnerable Software and Affected Versions LobsterAI versions prior to 2026.10.16 Description An issue exists where exported provider API keys are encrypted using a hardcoded password 'lobsterai-APP'. An attacker who obtains a provider export file can use this constant with PBKDF2 a ke...

PT-2026-116608

Name of the Vulnerable Software and Affected Versions Teable versions prior to 2026-10-12T12-45-53Z.3331 Description An authorization bypass allows authenticated users to rename folders in bases to which they do not belong. This occurs because the PATCH '/api/base/:baseId/node/folder/:folderId'...

PT-2026-117030

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the net/sched: cls api component when two concurrent tc filter add requests occur on the same chain or priority of an unlocked classifier. Both requests execut...

PT-2026-117151

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSH TRUSTED USER CA KEYS and accepts arbitrary principals SSH AUTHORIZED PRINCIPALS ALLOW=anything, a user could...

CVE-2026-110311: Exposure of Sensitive Information to an Unauthorized Actor

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata file name, UUID, upload time, size...

CVE-2026-112004: Authorization Bypass Through User-Controlled Key

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

PT-2026-116550

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from...

PT-2026-116605

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manage users and edit users can set a new owner password, clear...

Use of Single-factor Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication via UserController::updateData api/user/data/update, which does not require the current password when changing an...

Cross-site Request Forgery (CSRF)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Th...

Cross-site Request Forgery (CSRF)

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Th...

Authorization Bypass Through User-Controlled Key

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the update method in FaqController.php, where the REST API FAQ update endpoint enforces only a glob...