CVE-2026-111764

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-109700

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

CVE-2026-113648

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-90800

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...

EUVD-2026-105100

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

EUVD-2026-105092

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

CVE-2026-113677 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

EUVD-2026-105093

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

CVE-2026-113677 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

CVE-2026-113677

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to a missing authorization flaw in the SubDomains.delete API command. This allows authenticated customers to delete reseller-provisioned main domains by providing a specific main domain ID, bypassing web UI restrictions. Successful exploitation...

CVE-2026-113676

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to an authorization bypass in the Admins.get API command. This vulnerability is caused by identifier confusion , allowing authenticated resellers to read sensitive records belonging to other administrators. By providing their own loginname comb...

CVE-2026-113612

The SparkyFitness application (versions prior to 0.17.0 ) contains a missing authorization vulnerability (CWE-862) within the DELETE /api/foods/food-variants/:id endpoint. This flaw allows authenticated users to delete serving and nutrition variants belonging to other users. Attackers can identif...

EUVD-2026-105090

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113610

Xen Orchestra versions prior to 6.9.0 are vulnerable to an authorization bypass within the xo-server user.set API method. This flaw allows low-privileged authenticated users to modify the preferences of other users by providing an arbitrary target user ID. Consequences include the ability to dele...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...