PT-2026-120581

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

PT-2026-120580

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

PT-2026-120579

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...

PT-2026-120582

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

PT-2026-120578

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and...

PT-2026-120577

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get users by group course, user by all roles,...

PT-2026-120576

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open answer...

PT-2026-120574

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

PT-2026-120589

Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied id and username fields. Attackers can supply a username like /../../../x to bypass the...

PT-2026-120608

WarehousePG WHPG 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability CWE-862 in the built-in function gp log backend memory contexts. Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on...

PT-2026-120610

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gp add coordinator standby. The function is named gp add master standby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove...

PT-2026-120609

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in the built-in cluster expansion functions gp expand lock catalog and gp expand bump version. Any authenticated database role can run them, and neither checks privileges. ...

Linux Distros Unpatched Vulnerability : CVE-2026-109561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because...

JetBrains YouTrack < 2026.2.19575 / 2026.3.x < 2026.3.16075 Missing Authorization (CVE-2026-111092)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.19575, or 2026.3.x prior to 2026.3.16075. It is, therefore, affected by a missing authorization vulnerability: - In JetBrains YouTrack before 2026.2.19575, 2026.3.16075, 2026.3.16397, 2026.3.16402 mail rules allowed...

PT-2026-120195

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER SECRET KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key...

PT-2026-120647

The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat id as webhook:route name:delivery id and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix...

Linux Distros Unpatched Vulnerability : CVE-2026-15577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user or service account with read-only access to Git Sync provisioning connections can modify a connection's configuration through its status subresource...

AutoRepeater

AutoRepeater: Automated HTTP Request Repeating With Burp Suite tl;dr Within extender import AutoRepeater.jar Some Brief Instructions AutoRepeater will only resend requests which are changed by a defined replacement. When AutoRepeater receives a request that matches the conditions set for a given...

CVE-2026-81212

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an improper authorization flaw (CWE-285) that allows an unauthenticated user to perform an arbitrary write into the shared Redis instance. This vulnerability allows an anonymous caller to write data under any tenant's key, effectively c...

CVE-2024-9821

CVE-2024-9821 Bot for Telegram on WooCommerce = 1.2.4 - Authenticated Subscriber+ Telegram Bot Token Disclosure to Authentication Bypass Description The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on th...