CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...

CVE-2026-94618 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...

CVE-2026-120474

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original...

CVE-2026-116592

The undici HTTP client for Node.js is vulnerable to cache poisoning and cross-user disclosure in versions 7.30.1 and 8.12.2 through 8.12.3 . When an originless Agent uses both redirect and shared cache interceptors, the software incorrectly inspects only the final redirect hop to determine if a r...

CVE-2026-116592 undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops

undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which...

UBUNTU-CVE-2026-120474

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original...

EUVD-2026-117155

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-54378

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-54378

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to a broken access control flaw. By calling the POST /front/user/s3/token/ endpoint, any authenticated user can obtain temporary AWS credentials that are improperly scoped. This allows an attacker to list the shared storage bucke...

CVE-2026-103002

GPUStack, an open-source GPU cluster manager, is vulnerable to a missing authorization flaw in versions 2.2.0 through 2.2.2 . The cluster_apiserver_proxy component fails to perform resource-level authorization checks when forwarding requests from authenticated non-administrator users to a Kuberne...

CVE-2026-103002 GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, clusterapiserverproxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a...

CVE-2026-103002 GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, clusterapiserverproxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a...

WordPress Premium Packages plugin < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure vulnerability

Unauthenticated Cross-User Saved Cart Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin WPDM – Premium Packages versions 7.3.1...

PT-2026-137213

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description Broken access control allows authenticated users to obtain temporary AWS credentials via the 'POST /front/user/s3/token/' endpoint. These credentials have overly broad scopes, enabling...

CVE-2026-121458

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458

Versions of Instatic prior to 0.0.21 are vulnerable to a missing authorization flaw in the AI/MCP content read tools . The root cause is a lack of object-level authorization checks in the content_get_document and content_list_documents functions, which are otherwise enforced by the standard HTTP ...

EUVD-2026-115812

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...

CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments...