CVE-2026-112014: Use of Hard-coded Cryptographic Key

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...

PT-2026-116535

Name of the Vulnerable Software and Affected Versions makeplane plane versions prior to 1.4.3 Description An issue exists within the API Endpoint component where the system relies on untrusted inputs when making security decisions. A remote attacker can exploit this by manipulating the...

PT-2026-117157

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.3 Gitea versions prior to 28.0.0 Description Seven API endpoints under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys, and gpg keys were registered without the...

PT-2026-116608

Name of the Vulnerable Software and Affected Versions Teable versions prior to 2026-10-12T12-45-53Z.3331 Description An authorization bypass allows authenticated users to rename folders in bases to which they do not belong. This occurs because the PATCH '/api/base/:baseId/node/folder/:folderId'...

PT-2026-117151

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSH TRUSTED USER CA KEYS and accepts arbitrary principals SSH AUTHORIZED PRINCIPALS ALLOW=anything, a user could...

CVE-2026-110311: Exposure of Sensitive Information to an Unauthorized Actor

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata file name, UUID, upload time, size...

CVE-2026-112004: Authorization Bypass Through User-Controlled Key

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

PT-2026-116550

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from...

PT-2026-116618

Name of the Vulnerable Software and Affected Versions LobsterAI versions prior to 2026.10.16 Description An issue exists where exported provider API keys are encrypted using a hardcoded password 'lobsterai-APP'. An attacker who obtains a provider export file can use this constant with PBKDF2 a ke...

PT-2026-116605

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manage users and edit users can set a new owner password, clear...

PT-2026-117030

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the net/sched: cls api component when two concurrent tc filter add requests occur on the same chain or priority of an unlocked classifier. Both requests execut...

Use of Single-factor Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Use of Single-factor Authentication via UserController::updateData api/user/data/update, which does not require the current password when changing an...

Cross-site Request Forgery (CSRF)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Th...

Cross-site Request Forgery (CSRF)

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Th...

Authorization Bypass Through User-Controlled Key

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the update method in FaqController.php, where the REST API FAQ update endpoint enforces only a glob...

Authorization Bypass Through User-Controlled Key

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the update method in FaqController.php, where the REST API FAQ update endpoint enforces only a glob...

Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the deleteUser API in src/phpMyFAQ/Controller/Administration/Api/UserController.php, where an authenticated non-superadmin use...

CVE-2026-111930

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111928

Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the aclallow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from ...