CVE-2026-73068 ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

EUVD-2026-56186

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

CVE-2026-72921

SeaweedFS CVE-2026-72921 affects the filer server component where the authorization check used strings.HasPrefix on raw path strings, allowing a JWT scoped to /tenant1 to access sibling paths like /tenant1234, /tenant1-old, and /tenant1backup. Root cause: prefix-based path matching without proper...

EUVD-2026-56159

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

CVE-2026-19539

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content title, description, and attachments of tickets belonging to another company, to hijack another company's...

Azure CycleCloud Information Disclosure Vulnerability

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...

Windows Installer Elevation of Privilege Vulnerability

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally...

Microsoft SharePoint Server Tampering Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network...

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

.NET Framework Elevation of Privilege Vulnerability

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network...

Microsoft Exchange Server Security Feature Bypass Vulnerability

Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network...

Visual Studio Code Remote Code Execution Vulnerability

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network...

Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability

Incorrect authorization in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to disclose information locally...

Visual Studio Code Security Feature Bypass Vulnerability

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

Windows Defender Firewall Service Security Feature Bypass Vulnerability

Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally...

CVE-2026-19539

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content title, description, and attachments of tickets belonging to another company, to hijack another company's...