Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite

Hoppscotch self-hosted backend = 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWTSECRET to forge tokens and fully compromise the server, exploit requires attacker to access...

laravel-access-control-lab

laravel-access-control-lab A deliberately vulnerable Larave...

CVE-2026-77710

misp-stix (the MISP STIX import library) is vulnerable to STIX2 parser confusion and mass assignment (CWE-915, CWE-807). The import logic selected between the internal MISP parser and the external STIX parser based on untrusted metadata—MISP-specific tool labels (STIX2) or document title (STIX1)—...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Summary The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard-user-update$request-except'token'. Because the controller uses except'token' rather than $request-validated or the restricted keys defined in AccountInfoRequest::validationData, an...

CVE-2026-62315 Frappe: Mass assignment via set_value

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-62315

Frappe (full-stack web application framework) is affected by a type confusion vulnerability in frappe.client.set_value (frappe/client.py) in version 16.31.0 and earlier . The function validates a dictionary supplied via the fieldname parameter against forbidden standard and child-table fields bef...

EUVD-2026-63539

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-62315 Frappe: Mass assignment via set_value

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-18270

Kenwood DNR1007XR devices are affected by a local privilege escalation vulnerability in the udhcpd service. The root cause is an incorrect permission assignment on a resource used by the service, allowing an attacker with low-privileged code execution to escalate to root . The CVSS 3.0 score is 7...

CVE-2026-14949

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...

CVE-2026-76372 Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76372

CVE-2026-76372 affects the Nmap Scanner connector for Splunk SOAR in versions below 3.0.15 . The root cause is an incorrect permission classification: the connector's action manifest marks the scan network action as read-only , yet the action accepts Nmap Scripting Engine (NSE) script parameters ...

CVE-2026-76371 Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

CVE-2026-76260

CVE-2026-76260 is an incorrect permission assignment vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The properties REST endpoint checks for the rest_properties_get capability instead of the more restrictive list_storage_passwords capability, allow...

EUVD-2026-62259

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

CVE-2026-53958

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id...

CVE-2026-53958 4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id...

CVE-2026-53958

4gaBoards versions prior to 3.3.9 are vulnerable to an SSO pre-account takeover via mass assignment. The whitelist in server/api/controllers/users/update.js permits an authenticated user to modify backend-managed identity fields (e.g., ssoGithubId, ssoGoogleId, ssoOidcId) through PATCH /api/users...