CVE-2026-31309

Affected software: Mysterium Node (before v1.36.0). Vulnerability: Improper authorization in the /tequilapi/config/user endpoint allows an unauthenticated attacker to arbitrarily overwrite the node configuration, potentially leading to full node takeover. Affected versions: v1.21.1-rc0 up to (but...

PT-2026-56623

Name of the Vulnerable Software and Affected Versions Generic OEM UZ801 v2.1 4G LTE Router version 3.4.3 Description A remote attacker can execute arbitrary code through the /ajax web management API endpoint located within the MifiService.apk component. Recommendations At the moment, there is no...

PT-2026-56542

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.83.10-stable Description LiteLLM is a proxy server that functions as an AI Gateway for calling LLM APIs. The '/health/test connection' endpoint resolves request-supplied environment and OIDC file references within t...

CVE-2026-52200

An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk...

CVE-2026-35552

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's...

PT-2026-56568

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 6.20.0 Description An open redirect and server-side request forgery SSRF issue exists where attackers can redirect users to arbitrary URLs or perform client-side SSRF. This occurs when unvalidated HTTP/HTTPS URLs are...

CVE-2026-52200

The Crunch CVE-2026-52200 affects Generic OEM UZ801_v2.1 4G LTE Router in firmware V3.4.3. A remote attacker can execute arbitrary code via the /ajax web management API endpoint in MifiService.apk, leading to full device compromise. The available connected records do not provide deeper root-cause...

CVE-2026-39178

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...

PT-2026-56457

Name of the Vulnerable Software and Affected Versions Harness versions prior to 2.28.2 Description A remote authorization bypass exists within the gitspaces component. The issue resides in the getAuthorizedSpaces function located in the app/api/controller/gitspace/list all.go file. An attacker ca...

CVE-2026-31309

Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request...

GHSA-GVHC-WV3V-7PF8 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Summary Authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOverview only checks lenuser.Roles 0, so it returns...

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Summary Authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOverview only checks lenuser.Roles 0, so it returns...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GetOverview handler in pkg/system/handler.go. An attacker can retrieve aggregate inventory and capacity data for a cluster they are not allowed to access by sending GET /api/v1/overview with x-cluster-name...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GetOverview handler in pkg/system/handler.go. An attacker can retrieve aggregate inventory and capacity data for a cluster they are not allowed to access by sending GET /api/v1/overview with x-cluster-name...

CVE-2026-55077

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/user/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's passwor...

CVE-2026-55077

CVE-2026-55077 affects CodeR (github.com/coder/coder) prior to certain patched releases. The vulnerable endpoint is PUT /api/v2/users/{user}/password, which previously allowed a user-admin to reset an owner’s password because the permission set was limited to ActionUpdatePersonal and did not requ...

CVE-2026-55077 Coder: User-admin role can reset owner account password

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/user/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's passwor...

CVE-2026-55077 Coder: User-admin role can reset owner account password

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/user/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's passwor...

CVE-2026-59704

Cap’s GET /api/video/ai endpoint lacks proper ownership/membership validation, exposing private video AI metadata (titles, summaries, chapters) and enabling authenticated attackers to solicit arbitrary video IDs to read sensitive content. This may also trigger unauthorized AI generation that depl...

CVE-2026-54601

FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticated tenant user to call POST /api/core/dataset/collection/create/reTrainingCollection in a way that persists a server-owned datasetId value from another tenant. This creates mixe...