CVE-2026-68980

CVE-2026-68980 affects Apache NiFi 2.0.0–2.10.0. The issue is an authorization bypass in Asset management for Parameter Contexts via the REST API: deletion of an Asset is authorized by the provided Parameter Context Identifier without validating the Asset Identifier against the stored one. This c...

CVE-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

CVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

CVE-2026-69083 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

CVE-2026-69083

CVE-2026-69083 affects SiYuan versions before 3.7.3. The issue is a SQL injection in the fullTextSearchAssetContent endpoint, reachable by unauthenticated users, with published RoleReader tokens. The root cause is unescaped method parameters and REGEXP clauses that allow an attacker to run arbitr...

PT-2026-67405

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Unauthenticated users can exploit SQL injection in the 'fullTextSearchAssetContent' endpoint. By using unescaped method parameters and REGEXP clauses, attackers can execute arbitrary SQL commands on t...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310

CVE-2026-67310 concerns OpenRemote

EUVD-2026-51838

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

XRP Volatility Surges as Cybersecurity Threats and Market Changes Raise New Concerns

XRP volatility drives faster crypto trading as AI tools gain traction, while phishing, exchange attacks and automation risks test digital asset safeguards...

Top 7 Enterprise IT Asset Management Software for 2027

Compare 7 enterprise IT asset management platforms for 2027, covering security, automation, cost, compliance, lifecycle tracking and business requirements...

SUSE CVE-2026-53519

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefi...

CVE-2026-67347

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

CVE-2026-67347

Vendure 3.7.1 contains a cross-channel authorization bypass. In stock-location.service.ts and asset.service.ts update methods, channel-scoped administrators can supply global IDs from different channels to overwrite inventory locations or catalog assets belonging to other tenants, bypassing chann...

CVE-2026-67347 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

EUVD-2026-51150

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

CVE-2026-43738

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a maliciously crafted asset catalog may result in disclosure of process memory...

CVE-2026-43738

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a maliciously crafted asset catalog may result in disclosure of process memory...