CVE-2026-82395

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

CVE-2026-82395

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

CVE-2026-82395

CVE-2026-82395 is an IDOR (authorization bypass) in Sulu , an open-source PHP CMS built on Symfony. Prior to versions 2.6.25 and 3.0.8 , the media move endpoint (MediaManager::move() in MediaManager.php) derives its permission check from the client-supplied collection rather than the media item's...

CVE-2026-82919

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function createapp of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-54600

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...

EUVD-2026-68886

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...

CVE-2026-77348

Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-82882

Devtron versions through 2.2.0 fail to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint. Any user with a valid authenticated account can query this endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens...

CVE-2026-82919 cu silicon edit Endpoint views.py create_app missing authentication

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function createapp of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

CVE-2026-82919

A missing authentication vulnerability was identified in cu silicon up to version 0.1.5 , affecting the create_app function in views.py within the edit Endpoint component. A remote attacker with no prior authentication can exploit this flaw, resulting in low impact on confidentiality, integrity, ...

CVE-2026-82919 cu silicon edit Endpoint views.py create_app missing authentication

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function createapp of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

EUVD-2026-68815

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function createapp of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...

CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...