CVE-2026-111702

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...

CVE-2026-111702 ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...

EUVD-2026-102994

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...

CVE-2026-111696 data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111696

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111696 data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

EUVD-2026-102986

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

EUVD-2026-102987

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111695

The Shaiwz data-platform-open software (through commit efeacd3 ) contains an Insecure Direct Object Reference (IDOR) vulnerability in its Datasource API. Authenticated workspace members can access datasources belonging to other workspaces by providing foreign sequential numeric IDs. Specifically,...

CVE-2026-111696

The data-platform-open application (through commit efeacd3 ) is vulnerable to a hardcoded AES key issue in the AesPasswordEncAndDecServiceImpl component. This use of a publicly known default key allows authenticated attackers to decrypt stored datasource passwords. Attackers can retrieve cipherte...

CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111691

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

EUVD-2026-102982

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111691

The WIMOOR software (through commit ec86736 ) contains an authentication bypass vulnerability caused by the processing of an unsigned X-USERINFO header. Attackers who can reach backend service ports directly—bypassing the gateway—can forge companyid and manager or admin usertype values. This allo...

CVE-2026-111679

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...