CVE-2026-96283 Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

CVE-2026-96283

GHSA-89xm-3m96-w3jg: cross-user CancelPull orphans another user's ongoing pull...

CVE-2026-96283

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 データ漏洩の脆弱性 概要 CVE-2024-52317 は、Apache Tomcat の HTTP/2 実装に影響を与える脆弱性です。この問題は、HTTP/2 のリクエストおよびレスポンスリソースの不適切な再利用に起因し、ユーザー間でデータ漏洩が発生する可能性があります。つまり、あるユーザーの機密データが別のユーザーに送信されるレスポンスに現れる可能性があります。 影響を受けるバージョン 次の Apache Tomcat バージョンが影響を受けます： バージョンシリーズ|...

CVE-2026-33555

HAProxy H3/QUIC スタンドアロン FIN ボディ検証バイパスによる HTTP リクエストスマグリング 完全な記事はこちら : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html 概要 HAProxy の HTTP/3 実装における脆弱性により、攻撃者は実際のボディサイズと一致しない Content-Length ヘッダーを含む HTTP リクエストを送信できます。HAProxy はこの不正なリクエストを、宣言された Content-Length...

CVE-2025-46818

CVE-2025-46818 – Redis Lua サンドボックスのクロスユーザーエスケープ 非推奨のLua APIと変更可能なメタテーブルを介した、Redis 8.2.1におけるサンドボックスエスケープ。 概要 Redis 8.2.1は、非推奨のLua組み込み関数（getfenv、setfenv、newproxy）をスクリプトに公開したままにしており、基本型のメタテーブルをロックできていません。攻撃者は共有メタテーブルにメソッドを注入し、特権環境を取得して、別のユーザーの権限でコマンドを実行できます。 環境 Redisサーバー 8.2.1（または8.2.2より前の脆弱性のあるリリース...

GHSA-GVF2-2RH5-MPGF OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation のメモリAPIにおける所有権チェックの欠如により、ユーザー間をまたいだメモリの読み取りと削除が可能でした。 主なアドバイザリ: GHSA-qv97-83w4-ff86 研究者クレジット: @chaitanyagarware 早見表 フィールド| 値 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project| vmDeshpande/ai-agent-automation Package| backend Ecosystem| npm 深刻度| 高 CVS...

CVE-2026-84150 Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-84150

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin is vulnerable in versions before 8.9.5 . The application fails to verify if the target user of a REST route matches the authenticated caller when accessing or modifying saved favorites. This allows any auth...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write vulnerability

Subscriber+ Cross-User Favorites Read and Write vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.9.5...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

CVE-2026-77520 MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...

CVE-2026-77520

MaxKB (open-source enterprise AI assistant) in versions 2.10.2-lts and earlier has an authorization flaw in the homepage application question-ranking endpoint. A normal user in the same workspace can extract another user's application_id when the victim's published application has ranking activit...

CVE-2026-73548

CVE-2026-73548 affects Envoy (open source edge/service proxy) prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 . The root cause is that Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts it. An unauthenticated HTTP/2 client can smuggle a complete HTTP/1.1 requ...

CVE-2026-73548 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...

CVE-2026-94497

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks...

CVE-2026-61747

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no...

CVE-2026-61747

InvenTree , an open-source inventory management system, is affected by an authenticated IDOR vulnerability in its data-import API prior to version 1.4.0 . The /api/importer/row/ and /api/importer/mapping/ endpoints fail to scope DataImportRow and DataImportColumnMap querysets to the owner of the ...