CVE-2026-96627

The Arcane Docker management interface (versions

EUVD-2026-103178

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96627 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-111720

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...

CVE-2026-111642

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token...

CVE-2026-111720

The fish-island-backend software (specifically versions through commit 7c61b78 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw exists in the GET /api/web/parse endpoint, where the application fails to properly validate the url parameter. Remote at...

CVE-2026-111720 fish-island-backend through commit 7c61b78 SSRF via /api/web/parse

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...

EUVD-2026-103012

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...

CVE-2026-111720 fish-island-backend through commit 7c61b78 SSRF via /api/web/parse

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...

CVE-2026-111691

The WIMOOR software (through commit ec86736 ) contains an authentication bypass vulnerability caused by the processing of an unsigned X-USERINFO header. Attackers who can reach backend service ports directly—bypassing the gateway—can forge companyid and manager or admin usertype values. This allo...

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111642 FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token...

EUVD-2026-103064

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token...

CVE-2026-111642 FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token...

CVE-2026-111642

Versions of FastapiAdmin through 3.0 are vulnerable to a privilege escalation flaw due to a hard-coded JWT signing secret located in backend/app/config/setting.py. A low-privileged attacker can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and subsequently forge ...

CVE-2026-64959

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

EUVD-2026-102854

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

PT-2026-115603

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 5 through 5.0.4 Description An issue involving missing authentication for critical functions and improper neutralization of special elements used in SQL commands allows for SQL Injection. This occurs when certain backend...