CVE-2026-113619 Eclipse ioFog renders request templates before authentication

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...

CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass

Pingora versions prior to 0.9.0 accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.reqheader.uri saw the :authority value, but the upstream received the client-supplied Host value. Pingora...

CVE-2026-76151

A flaw was found in the QtNetwork module of the Qt Framework. This out-of-bounds read vulnerability allows a remote attacker to cause a denial of service application crash. This occurs when an application using QNetworkAccessManager processes an excessively large HTTP Cache-Control header value...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

EUVD-2026-104965

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949

Cruise Control for Apache Kafka is vulnerable to an authentication bypass due to a misconfiguration in the Jetty ConstraintSecurityHandler . The handler registers security constraints on exact path specifications but fails to use a catch-all wildcard constraint or call setDenyUncoveredHttpMethods...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

OffensiveNotion

OffensiveNotion Notion yes, the notetaking app as a C2. A collaboration by: Documentation | Pull Requests | Issues !Pull...

WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taegyeong Yun in WordPress Plugin Paid Member Subscriptions versions = 3.1.2...

CVE-2026-112068

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

CVE-2026-112069

The FAL Protect (fal_protect) extension contains a Broken Access Control vulnerability (CWE-862) when used on websites running TYPO3 14.3 . The extension fails to apply access protection to files within file storages using a non-default relative base path , allowing these files to be served direc...

CVE-2026-112069 Broken Access Control in extension "FAL Protect" (fal_protect)

The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website...

CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...

CVE-2026-112240

The TYPO3 Fluid-Form by coding.ms (fluid_form) extension contains a broken access control vulnerability. The issue stems from a predictable token used in download links for files uploaded via forms, combined with insufficient verification of the file name in requests. This allows an unauthenticat...

CVE-2026-112071 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071

The TYPO3 Shop by coding.ms extension contains a Broken Access Control vulnerability (CWE-862) in its order cancellation function. The application accepts an order identifier from a request and processes the cancellation without verifying if the requester owns the order. Consequently, any site vi...

CVE-2026-113468 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the...