CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-109285

Open WebUI versions 0.6.0 before 0.11.4 are vulnerable to an improper access control flaw within the has_access_to_file function. The root cause is the retention of stale cached knowledge base references , which allows former collaborators to maintain unauthorized access to files. An attacker wit...

EUVD-2026-97587

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

WordPress FluentBoards authorization issue vulnerability

WordPress FluentBoards versions 2.1.0 and earlier have a licensing issue vulnerability. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

Ivanti Neurons Patch for Intune: Permissions licensing and access control issues

The Ivanti Neurons Patch for Intune has vulnerabilities related to permissions and access control. These vulnerabilities stem from exposed dangerous endpoints, which may allow remote, authenticated attackers to disclose sensitive authentication information...

WordPress Pay for Payment for WooCommerce authorization issue vulnerability

WordPress Pay for Payment in WooCommerce 3.0.1 and earlier versions has an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks, which may allow attackers to exploit improperly configured access control levels...

Schneider Electric Sage RTU 1410 input validation error vulnerability

The Schneider Electric Sage RTU 1410, Sage RTU 1430, Sage RTU 1450, Sage RTU 2400, Sage RTU 3030 Magnum, and Sage RTU 4400 C3414-500-S02L0 previous versions have a vulnerability related to input validation errors. This vulnerability stems from insufficient data authenticity verification, which ma...

The-40-Thieves obsidian-tc backend link vulnerability

The The-40-Thieves obsidian-tc versions before 1.3.1 have a security vulnerability. This vulnerability stems from reading the access control list, where the check for lexical paths includes checking resolved paths as well. This allows symbolic links within libraries that are allowed by wildcarded...

ProPhoenix Law Records Management Software has a security vulnerability

ProPhoenix Law Records Management Software v2022.2403.3.101 has a security vulnerability. This vulnerability stems from improper access control measures at sensitive API endpoints, which may allow unauthorized access...

WordPress WP User Manager Authorization Vulnerability

WordPress WP User Manager versions 2.9.23 and earlier have a vulnerability related to authorization. This vulnerability stems from an absence of proper authorization checks, which may lead to exploitation by improperly configured access control levels...

WordPress Amelia authorization issue vulnerability

WordPress Amelia versions 2.4.10 and earlier have a vulnerability related to authorization. This vulnerability arises due to a lack of authorization, which may lead to the exploitation of incorrectly configured access control levels...

LeapWorx Premium Addons for Elementor: Authorization Issues and Vulnerabilities

LeapWorx Premium Addons for Elementor 4.11.110 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization, which may lead to exploitation by incorrectly configured access control levels...

Kerwin FastBee authorization issue vulnerability

Kerwin FastBee versions 2.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DeviceController. Certified low-privilege users can read and modify devices of other tenants by providing the sequential device ID...

Malware in @wanzxlonelyy/bailslonely

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @wanzlonelyy/bailslonely

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @wanzlonely/bails4u

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...