CVE-2026-107366 Langflow OSS Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session...

CVE-2026-107366

IBM Langflow OSS versions 1.0.0 through 1.12.4 are vulnerable to an authorization bypass (CWE-639) because three message endpoints fail to perform ownership verification. This flaw allows any authenticated user to perform unauthorized actions, including bulk-deleting another user's messages, over...

CVE-2026-112776

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776

Craft CMS versions 5.0.0 through 5.11.0 are vulnerable to a GraphQL Site-Scope Bypass via mutations. The root cause is the failure to enforce the requireAllowedSite() function, allowing site-scoped GraphQL tokens to interact with content from other sites. An attacker holding a valid token for one...

EUVD-2026-104582

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-84178

CVE-2026-84178 — camel-oauth: authorization-code callback login CSRF missing state Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the OAuth authorization-code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

CVE-2026-18329

A flaw was found in NGINX. When the NGINX JavaScript njs or QuickJS qjs engines process asynchronous request bodies, an exception during access-control evaluation can cause the jsaccess phase to fail open before an explicit denial is returned. An unauthenticated remote attacker can exploit this b...

CVE-2026-17183

A flaw was found in Grafana's Unified Alerting component. An authenticated user with permissions to create or edit alert rules in a folder can bypass datasource query permissions. By manipulating the queryType field, an attacker can execute queries against datasources they are not authorized to...

CVE-2025-10149

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...

EUVD-2025-211118

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...

Exploit for CVE-2026-85251

CVE-2026-85251 — camel-http: credential disclosure on redirect...

CVE-2026-109433

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109431

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

CVE-2026-107568

Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...

CVE-2026-107566

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

CVE-2026-107566

Progressive Robot hMailServer versions 6.2.22 through 6.3.6 are vulnerable to a missing authorization flaw in the Sieve editheader action and the mail-rule Set header value action (v6.0.0 through 6.3.6). This allows an authenticated user to manipulate headers such as From , Sender , and DKIM-Sign...

CVE-2026-107566 Missing Authorization in hMailServer

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

CVE-2026-107566 Missing Authorization in hMailServer

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...