CVE-2026-81525

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

CVE-2026-81524

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

CVE-2026-81522

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

CVE-2026-81668

Katello (also tracked as rubygem-katello ) contains an authorization flaw in the Content View Filter Rules API . The API does not properly enforce authorization on the parent Content View Filter , allowing an authenticated, low-privileged user with Content View permissions in one organization to ...

CVE-2026-81668 Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...

CVE-2026-81658

Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...

CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO 인증 우회 요약 FortiCloud SSOSingle-Sign-On는 FortiGate/FortiManager/FortiAnalyzer를 등록하면 공장 기본값으로 활성화되는 기능으로, 여기에 심각한 인증 우회 결함이 존재합니다. 공격자가 FortiCloud 계정무료 또는 유료을 보유하고 있다면, 자신의 SSO 토큰을 재사용하여 다른 고객의 장비아래 나열된 빌드 이하에 비밀번호를 알지 못한 채 로그인할 수 있습니다. 익스플로잇 이후에는 전체 관리자 GUI 및 루트 셸 접근...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris: register에서 위치 검증 전 자격 증명 발급 CVE-2026-64640 용 자체 포함된 단일 명령어 재현 도구: Apache Polaris의 Iceberg REST register 엔드포인트는 호출자가 제공한 경로에 대해 클라우드 스토리지 자격 증명을 발급하고 카탈로그의 allowedLocations와 대조하여 검사하기 전에 해당 경로를 서버 측에서 읽습니다. 자신의 카탈로그에서 테이블을 생성하는 권한만 가진 principal은 Polaris가 카탈로그의 스토리지...

CVE-2026-23552

CVE-2026-23552 - camel-keycloak में क्रॉस-रील्म टोकन स्वीकृति अवलोकन Apache Camel का KeycloakSecurityPolicy JWT टोकन के iss जारीकर्ता दावे को कॉन्फ़िगर किए गए realm के विरुद्ध मान्य नहीं करता है। इसका मतलब है कि एक Keycloak realm द्वारा जारी किया गया टोकन पूरी तरह से अलग realm के लिए कॉन्फ़िगर की...

CVE-2026-57830

Helix Ultimate Framework — 未经身份验证的路径遍历导致任意文件/文件夹读取+删除 这是一个已确认的拒绝服务 + 跨租户文件系统访问漏洞，并非远程代码执行。 关于远程代码执行升级的理论（删除 configuration.php 以重新暴露 Joomla 安装程序）已通过实际测试并被推翻——详见下文“远程代码执行升级——已测试并推翻”。在任何报告中，未经重新构建真实攻击链之前，不得将其描述为远程代码执行漏洞。 严重性升级（2026-07-06，第二轮评估）： path 参数并未如最初评估的那样被安全限制在 Joomla 的 Web 根目录内——Joomla 的 PA...

CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR

CVE-2026-52217 Défaut d'autorisation inter-locataire et inter-utilisateur IDOR / BOLA dans le service de validation de commande Checkout de la plateforme VTEX Commerce. Champ| Valeur ---|--- Identifiant CVE| CVE-2026-52217 Fournisseur| VTEX Produit| Plateforme VTEX Commerce, service Checkout chk...

Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM 크로스 테넌트 가입 우회 상태01.12.2025: 이 취약점은 여전히 활성 상태이며 악용 가능합니다. Microsoft는 이 문제를 패치하지 않았으며 이를 "의도된 설계by design"로 간주합니다. 보안 권고 GHSA-vcwf-73jp-r7mv CVE-2025-66390 요약 Azure API ManagementAPIM Developer Portal의 보안 취약점으로 인해, 관리자가 포털 UI에서 사용자 가입을 비활성화했더라도 공격자는 기본 인증Basic Authentication이 활성화된 모든 API...

EUVD-2026-66763

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

CVE-2026-6355

Augmentt: Accesso Cross-Tenant tramite IDOR Crediti Questa CVE è il risultato di uno sforzo collaborativo tra: Raznov – GitHub: https://github.com/basraznov HelloWorld Autore– GitHub: https://github.com/Penquinsecq Descrizione Una vulnerabilità nell'applicazione web consente a utenti non...

CVE-2026-77368

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

CVE-2026-77317

CVE-2026-77317 affects SeaweedFS (distributed file/blob storage system) versions 3.88 through 4.39. The SFTP server evaluates configured path permissions using a literal string-prefix comparison rather than requiring a path-component boundary. A user scoped to a path such as /tenants/alice is als...

EUVD-2026-66377

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-62861

TypeBot (chatbot builder) is vulnerable to cross-tenant custom-domain removal prior to 3.18.0 . The root cause is in the custom-domain delete handler (handleDeleteCustomDomain.ts): it authorizes a caller against a client-supplied workspaceId but forwards the client-supplied domain name to the sha...