CVE-2026-109184 jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to vie...

CVE-2026-109182 jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

EUVD-2026-97386

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182 jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182 jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

EUVD-2026-97384

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

CVE-2026-109180 jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

CVE-2026-109180

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

CVE-2026-109180 jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depotflag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints...

CVE-2026-109164 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the...

AI Usage Control: Why Employee AI Use Needs Its Own Category

Discover why traditional security tools leave gaps in enterprise AI use and how AI Usage Control AIUC provides crucial identity, data, and prompt-level risk governance...

MSC-2026-12786

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive user system data –...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

Sensitive Data Leak

Apache Syncope is vulnerable to a sensitive data leak. The vulnerability is due to improper handling of AES keys with non‑standard lengths, where the padded key value is logged and attackers can read the logs to obtain the secret key...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) CallHome component is affected by multiple vulnerabilities

Summary The CallHome component in IBM Cloud Pak for Data System 1.0 includes several open-source and third-party frameworks and packages as part of its management and diagnostic infrastructure. Multiple security vulnerabilities have been identified in underlying components, including Django, Go...

MAL-2026-17809 Malicious code in minecraftaccfinder (PyPI)

minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes 0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC with no description, author, README or project page. The package consists of one module, minecraftaccfinder/init.py about 87 KB, 88 functions...

MSC-2026-12873

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Exfiltrating sensitive user system data –...

CVE-2023-25996

Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0...

MSC-2026-12755

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive user system data –...