CVE-2026-6355

Augmentt: الوصول عبر المستأجرين عبر IDOR الاعتمادات كان هذا CVE جهدًا تعاونيًا بين: Raznov – GitHub: https://github.com/basraznov HelloWorld المؤلف – GitHub: https://github.com/Penquinsecq الوصف تسمح ثغرة في تطبيق الويب للمستخدمين غير المصرح لهم بالوصول إلى البيانات الحساسة ومعالجتها عبر مستأجرين...

CVE-2026-23552

CVE-2026-23552 - قبول التوكنات عبر العوالم Realms في camel-keycloak نظرة عامة لا يتحقق KeycloakSecurityPolicy في Apache Camel من مطالبة iss المُصدِر في توكنات JWT مقابل العالم Realm المهيأ. وهذا يعني أن توكنًا صادرًا عن عالم Keycloak واحد يُقبل بصمت من قِبل سياسة مهيأة لعالم مختلف تمامًا، مما يكس...

CVE-2026-55176

In Soft Machine versions 0.2.247 and prior , an authentication bypass exists in the /app/server.js file. The helper functions verifyContainerAuth() and authenticateWorkspaceHttp() incorrectly accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying workspace ownership. Since ...

EUVD-2026-89539

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 are vulnerable to an authentication bypass due to the use of a hard-coded constant for JWT verification in the realtime WebSocket and SSE service . This flaw occurs specifically when the AISOC_REALTIME_JWT_SECRET environment variable is not configured. Unauthent...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055: Use of Hard-coded Cryptographic Key

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-102876

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

EUVD-2026-89411

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876

SurrealDB versions prior to 3.3.0 are vulnerable to an authorization bypass during HTTP session construction. The root cause lies in the check_auth() function, which verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but erroneously constructs sessions using Surreal-NS and S...

CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876: Authorization Bypass Through User-Controlled Key

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

PT-2026-102892

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check auth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100608: Missing Authorization

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

PT-2026-99279

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description When the server operates in queue mode with the dashboard enabled and is not in cloud mode MODE=queue, ENABLE BULLMQ DASHBOARD=true, and !isCloud, the /admin/queues endpoint is protected only by the...