CVE-2026-108712

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108711

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...

DET

DET extensible Kit de Exfiltración de Datos DET se proporciona TAL CUAL, es una prueba de concepto para realizar Exfiltración de Datos usando uno o múltiples canales al mismo tiempo. Esta es una Prueba de Concepto destinada a identificar posibles fallos de DLP. Nunca debe usarse para exfiltrar...

caracal

Caracal Caracal es una herramienta de análisis estático sobre la representación SIERRA para contratos inteligentes de Starknet. Características Detectores para detectar código Cairo vulnerable Impresoras para reportar información Análisis de taint Marco de análisis de flujo de datos Fácil de...

CVE-2026-108760 LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API key...

CVE-2026-108754

Versions of GPT-Load through 1.4.11 are vulnerable to a cleartext logging flaw where the Gin Logger middleware records raw query strings. This occurs because the logging happens before the extractAuthKey function can strip the sensitive key parameter. An attacker with read access to console logs ...

CVE-2026-108754 GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...

EUVD-2026-96919

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys...

CVE-2026-108745 CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

CVE-2026-108745 CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

EUVD-2026-96910

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

CVE-2026-108720 phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...

CVE-2026-108715 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108715

LibreNMS versions through 26.9.1.1 are affected by an authorization bypass vulnerability in the includes/html/graphs/smokeping/auth.inc.php component. The root cause is an incorrect authorization check that validates the src probe device instead of the rendered target device . Consequently, restr...

CVE-2026-108715 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108712

SuiteCRM versions through 7.15.2 and 8.10.2 are affected by a missing authorization vulnerability in the DetailUserRole entry point. This flaw allows authenticated non-admin users to view the ACL data of other non-admin users. An attacker can achieve this by supplying another user's ID in the rec...

CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

EUVD-2026-96986

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108711

Plastic Labs Honcho versions through 3.3.0 are vulnerable to an incorrect authorization flaw (CWE-863) via the POST /v3/workspaces endpoint. The root cause is that the get_or_create_workspace function only validates the workspace claim, allowing API key holders with peer- or session-scoped access...