EUVD-2026-98058

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667

Frappe ERPNext versions before 15.111.0 and 16.x before 16.22.0 are vulnerable to a privilege escalation vulnerability. The root cause is a record-creation endpoint that accepts the record type from the request and inserts the data with permission checks disabled . An authenticated user, even wit...

CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667: Improper Privilege Management

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-93861

A flaw was found in OpenStack Mistral. An authenticated project that has been granted and accepted access to another project's private workflow can further delegate that access to a third, arbitrary project without the workflow owner's knowledge or consent. The unauthorized delegation succeeds...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc Multiple Vulnerabilities (crlsa-2026_73765)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673765 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogta...

CVE-2026-101105

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

CVE-2026-101105 code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

CVE-2026-101105

The Matrimonial System 1.0 (code-projects) is vulnerable to a remote SQL injection in the Profile Creation Endpoint . The flaw exists in the processprofile_form function within the /create_profile file, specifically caused by the improper handling of the fname argument. An attacker can exploit th...

EUVD-2026-88403

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

CVE-2026-101105 code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

CVE-2026-97335

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later fixed in 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any...

CVE-2026-101105: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

CVE-2026-97335: Incorrect Authorization

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later fixed in 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any...

PT-2026-102303

Name of the Vulnerable Software and Affected Versions Matrimonial System version 1.0 Description Remote SQL injection is possible via the Profile Creation Endpoint. The issue occurs in the processprofile form function within the /create profile file when handling the fname variable. SQL injection...

PT-2026-97670

Name of the Vulnerable Software and Affected Versions Drupal Commerce Decoupled Checkout versions 1.0.0 through 1.8.0 Description Improperly controlled modification of dynamically-determined object attributes allows for object injection. The module provides REST endpoints for remote order creatio...

CVE-2026-87031

Concrete CMS versions 9.2.0 through 9.5.3 contain a missing authorization check in the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php). Because no permission check was performed before account creation, any valid OAuth token car...

CVE-2026-82526 R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via stri...