CVE-2026-88617

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

PT-2026-92096

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0 Description The software exposes the raw Time-based One-Time Password TOTP shared secret after enrollment. This occurs through the 'GET /api/v1/user/settings/totp' and 'GET /api/v1/user/settings/totp/qrcode'...

CVE-2026-91980: Exposure of Sensitive Information to an Unauthorized Actor

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for...

PT-2026-91833

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

CVE-2026-90841 PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-91199

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91144

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

CVE-2026-12758

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers...

CVE-2026-91201

DocsGPT through 0.20.0 is affected by an OAuth token disclosure via a wildcard postMessage in the callback-status endpoint. Session tokens are posted without validating the sender origin, allowing an attacker acting as window.opener during the OAuth authorization flow to steal session tokens and ...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91199

Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...

CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

CVE-2026-91144

ZFile through 5.0.5 suffers from a share entry filter bypass on its download endpoint. The application fails to validate requested file paths against a share link's allowed entries, allowing an attacker holding a valid share link to supply arbitrary file paths as query parameters and download any...

CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret...

CVE-2026-90896 Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...