CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

EUVD-2026-105093

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orpha...

CVE-2026-113677

Froxlor versions 0.10.0 before 2.3.15 are vulnerable to a missing authorization flaw in the SubDomains.delete API command. This allows authenticated customers to delete reseller-provisioned main domains by providing a specific main domain ID, bypassing web UI restrictions. Successful exploitation...

CVE-2026-113612

The SparkyFitness application (versions prior to 0.17.0 ) contains a missing authorization vulnerability (CWE-862) within the DELETE /api/foods/food-variants/:id endpoint. This flaw allows authenticated users to delete serving and nutrition variants belonging to other users. Attackers can identif...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

EUVD-2026-105090

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

EUVD-2026-105088

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113610

Xen Orchestra versions prior to 6.9.0 are vulnerable to an authorization bypass within the xo-server user.set API method. This flaw allows low-privileged authenticated users to modify the preferences of other users by providing an arbitrary target user ID. Consequences include the ability to dele...

EUVD-2026-105085

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

CVE-2026-113607

The Configurable Reports block for Moodle versions before 5.3.0 is vulnerable to an authorization bypass in the block_configurable_reports_get_report_data web service. The root cause is that when check_permissions fails, the function only issues a warning but continues to return the full report t...

CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

EUVD-2026-105084

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/...

CVE-2026-113606

Stirling-PDF versions 3.0.0 through 3.2.0 are vulnerable to an authorization bypass (CWE-639) within the processing folders functionality. Authenticated users can access files belonging to other users by pointing a processing folder at the server storage directory via a POST /api/v1/processing-fo...

EUVD-2026-105169

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...

CVE-2026-113603 x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL...

CVE-2026-113603

The x402 SIWX server extension contains an authorization bypass vulnerability in @x402/extensions (versions 2.3.1 through 2.28.0), x402 PyPI (versions 2.11.0 through 2.25.0), and the Go module (versions 2.16.0 through 2.28.0). The root cause allows paying clients to unlock unpaid routes by provid...

CVE-2026-113601

Versions of Memos prior to 0.27.0 are vulnerable to a missing authorization flaw in the ActivityService ListActivities and GetActivity API methods. This vulnerability allows authenticated users to view activity records from all other users by enumerating sequential activity IDs. Impacted data inc...

EUVD-2026-105167

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...