Acronis Cyber Infrastructure Authorization Issue Vulnerability

Versions of Acronis Cyber Infrastructure prior to 6.0.1-112, 6.1.1-64, and 6.2.1-71 have vulnerabilities related to authorization checks. These vulnerabilities stem from improper authorization validation, which may lead to the exposure of sensitive information and data corruption...

Apache Traffic Server digital error vulnerability

A numerical error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability stems from improper handling of specially crafted HTTP/2 DATA frames, potentially leading to exhaustion of the worker pool on...

Apache Traffic Server has a vulnerability related to input validation errors.

The Apache Traffic Server versions 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0 have a input validation vulnerability. This vulnerability arises when the source server returns the connection back to the shared pool while it is still waiting for a request body that was not fully...

Data Intelligence Lab@HKU Vibe-Trading authorization issue vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is an authorization issue vulnerability. This arises because when APIAUTHKEY is not set, requireauth returns early, allowing unauthenticated attackers to access the FastAPI interface. They can post messages via...

MAL-2026-18098 Malicious code in security-research-startup-snapshot-810764b303 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on...

Malicious code in security-research-startup-snapshot-810764b303 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113612

The SparkyFitness application (versions prior to 0.17.0 ) contains a missing authorization vulnerability (CWE-862) within the DELETE /api/foods/food-variants/:id endpoint. This flaw allows authenticated users to delete serving and nutrition variants belonging to other users. Attackers can identif...

CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition...

CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

CVE-2026-113607

The Configurable Reports block for Moodle versions before 5.3.0 is vulnerable to an authorization bypass in the block_configurable_reports_get_report_data web service. The root cause is that when check_permissions fails, the function only issues a warning but continues to return the full report t...

CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

EUVD-2026-105168

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating...

EUVD-2026-105162

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

CVE-2026-113596

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...

CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...

CVE-2026-113359 Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the uniquerowvalues API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in...