CVE-2025-71420: Authorization Bypass Through User-Controlled Key

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...

CVE-2026-94277: Improper Neutralization of Input During Web Page Generation

MISP's galaxy matrix statistics view app/View/Users/statisticsgalaxymatrix.ctp renders the galaxy name directly into HTML output via sprintf without any HTML encoding. An authenticated user holding the permgalaxyeditor permission can create or modify a galaxy whose name contains arbitrary HTML or...

CVE-2026-88403

A Server-Side Request Forgery SSRF in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request...

CVE-2026-88403

A Server-Side Request Forgery (SSRF) vulnerability exists in the serverRequest function of nocobase v2.1.21 . This flaw allows authenticated attackers to perform internal resource scanning by sending a crafted HTTP request . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided...

PT-2026-96277

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description An issue exists where the server loads item content from an internal server ID without verifying if the authenticated user has the necessary permissions to access that item. An authenticated us...

PT-2026-96281

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.7.7 Description In Joplin Server instances where TRANSCRIBE ENABLED is set to true, the handlers for the endpoints "/api/transcribe/:id" GET and POST pass the decoded id directly into transcription backend URLs. An...

PT-2026-96184

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated user can add any other account to a group without requiring an owner role, an invitation token, target-user consent, or notification. This occurs because the endpoint...

PT-2026-96135

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0 Description GoCD can return unmasked credentials stored in the userinfo portion of source control material URLs. This occurs through several read-only APIs available to regular authenticated users. While dedicated...

PT-2026-96297

Name of the Vulnerable Software and Affected Versions Jazzware RT1000 Edge webUI version 20.0.1 Description The upgrade package upload functionality allows an authenticated attacker with administrative privileges to upload server-side executable files. These files are stored in a web-accessible...

PT-2026-96216

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description The '/api/importer/row/' and '/api/importer/mapping/' endpoints fail to scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. This allows any...

PT-2026-96105

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An issue exists where the system fails to consistently verify if a user has permission to access individual pieces of data when adding a reference between objects or attributes. While the system...

PT-2026-96117

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0 Description The internal GoCD UI '/jobStatus.json' API fails to validate if a requested server-assigned job ID belongs to the specified pipeline and stage. This allows an authenticated user to guess job IDs and...

PT-2026-96265

Name of the Vulnerable Software and Affected Versions NocoBase version 2.1.21 Description A Server-Side Request Forgery SSRF exists in the serverRequest function. This allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF is a flaw that allows...

PT-2026-96154

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.106.1 Description The WorkerStatus gRPC polling path in pkg/repository/durable events.go passes caller-supplied durable task, node, and branch identifiers to the ListSatisfiedEntries function without applying a tena...

PT-2026-96074

Name of the Vulnerable Software and Affected Versions temporalio/sqlparser affected versions not specified Temporal Server affected versions not specified Description The temporalio/sqlparser library allows SQL containing deeply nested unary expressions, resulting in a deep abstract syntax tree...

PT-2026-96185

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated low-privileged user can overwrite or permanently delete maintenance entry records belonging to other tenants. This occurs because the MaintenanceEntryRepository.Update and...

PT-2026-96308

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description The software fails to validate user identity in the 'PUT /anyone/baseInfo' and 'PUT /anyone/avatar' endpoints. This allows authenticated attackers to modify arbitrary user profiles by supplying...

PT-2026-96207

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description A tenant isolation bypass allows authenticated users to access records belonging to other tenants. By iterating the primary key, an attacker can enumerate and retrieve sensitive information across all...

CVE-2026-61851: Incomplete List of Disallowed Inputs

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-94572: Improper Control of Generation of Code

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...