CVE-2026-59255 BloodHound Missing Authorization on Custom Node Management API

BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting a...

CVE-2026-61643

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-/. The normal toolset routes deny access, but the workflow...

CVE-2026-61643 FastGPT: workflow runtime can execute another user's private HTTP toolset

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http-/. The normal toolset routes deny access, but the workflow...

CVE-2026-61740

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAGAPIKEY set but AUTHACCOUNTS unset, X-API-Key protection can be bypassed because lightrag/api/auth.py falls back to a hardcoded DEFAULTTOKENSECRET, /auth-status and /login can...

CVE-2026-61836

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role...

CVE-2026-47158 Vaultwarden: CSRF in SSO Authorization Flow

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact...

EUVD-2026-44693

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact...

Authorization Bypass Through User-Controlled Key

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized secret...

Authorization Bypass Through User-Controlled Key

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized secret...

Authorization Bypass Through User-Controlled Key

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized secret...

Authorization Bypass Through User-Controlled Key

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized...

Missing Authorization

Overview praisonai-platform is a Platform layer for PraisonAI — workspace, auth, issues, projects Affected versions of this package are vulnerable to Missing Authorization via the label and issue-label mutation endpoints. An attacker can modify shared label names and colors, as well as add or...

CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role...

CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role...

CVE-2026-61836

CVE-2026-61836 affects Directus: prior to 12.0.0, the cache-key derivation in api/src/utils/get-cache-key.ts used version, path, query, and accountability.user but omitted authorization context (share, role, roles, admin, app, policies). This allows Directus share tokens and anonymous requests to...

USN-8551-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined the same HTTP method. A remote attacker could possibly use this issue to bypass authorization restrictions. CVE-2026-43515 It was discovered that the Tomcat number guess example application di...

CVE-2026-46459

ICU Scandinavia Boomerang is affected by a missing authentication vulnerability in its device receiver endpoints. An unauthenticated remote attacker can read full facility configurations and write unauthorized data to the sensor database. The issue is mitigated by upgrading to version 2.4.18.029....

CVE-2026-46459 Missing Authorization in ICU Scandinavia Boomerang

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029...

CVE-2026-61440

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

CVE-2026-59236

Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...