CVE-2026-111662

Chaskiq versions through 2.0.3 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) via the /oembed endpoint. The root cause lies in the FetchLinkCardService , which fails to validate the url parameter, allowing attackers to force the server to fetch arbitrary URLs. This includ...

EUVD-2026-103066

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...

CVE-2026-111644

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...

CVE-2026-111644

Misaka Danmu Server versions through 2.8.9 are affected by a missing authentication vulnerability (CWE-306) located under the /api/ui routes. The root cause is the lack of the get_current_user dependency on specific endpoints, including audit, diagnostics, data-check, scan-index, and health route...

CVE-2026-111634

Helical Insight through version 7.0.0 is vulnerable to a SQL injection flaw located at the /executeDatasource endpoint. The root cause is the use of unescaped report parameter values which allows attackers to bypass the SqlDetect guard . Authenticated viewers can exploit this by supplying crafted...

EUVD-2026-103054

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or...

CVE-2026-111632

Aureus ERP versions through 1.6.0 contain an authorization bypass vulnerability (CWE-639) that compromises multi-company data segregation. Authenticated API users can bypass restrictions to create or move records into unauthorized companies by providing a foreign company_id . This flaw specifical...

CVE-2026-111632 Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or...

EUVD-2026-103051

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous...

CVE-2026-111629

IoTSharp versions through 3.6.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Customers and Devices API handlers. The root cause is a failure to scope database queries to the caller's specific tenant, allowing any authenticated user to access data from other te...

CVE-2026-111613

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...

CVE-2026-111613

Versions of AllData through 0.7.1 are vulnerable to an unauthenticated JDBC injection via the data-dts /jobJdbcDatasource/test endpoint. This vulnerability allows remote attackers to open arbitrary database connections by supplying malicious jdbcUrl and jdbcDriverClass values. Specifically, an at...

EUVD-2026-103035

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...

CVE-2026-92262

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

CVE-2026-59967

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting createdby to the requesting user when an authenticated member of a shared Space...

CookieViz

CookieViz Français CookieViz est un outil de visualisation qui permet de mesurer l'impact des cookies lors de votre propre navigation. Cookieviz analyse les interactions entre un navigateur et des sites et serveurs distants. Vous pourrez savoir à quels autres acteurs le site que vous visitez envo...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Jackson Databind

Summary IBM SPSS Modeler is affected by vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-54516 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

CVE-2026-59967 Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting createdby to the requesting user when an authenticated member of a shared Space...

CVE-2026-59967 Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting createdby to the requesting user when an authenticated member of a shared Space...

CVE-2026-59967

Prior to version 2.6.10 , Tandoor Recipes is vulnerable to a Cross-user IDOR in the /api/recipe-from-source/ endpoint. The application fails to restrict the created_by field when looking up a BookmarkletImport by its sequential primary key within a shared Space. An authenticated member can submit...