EUVD-2026-78788

Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitrary organization IDs. Attackers can add themselves as organization owners, create workspaces, and gain administrative access to victim...

CVE-2026-91929

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before performing operations. Attackers with legitimate Enterprise access can delete arbitrary workspaces , invite themselves into other organizations , modify cros...

EUVD-2026-78787

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse...

CVE-2026-91929 Flowise before 3.1.4 Cross-Tenant Authorization Bypass

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse...

CVE-2026-54076 ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-52826

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-52823

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...

CVE-2026-52825

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-44793

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2026-44793

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can...

CVE-2026-59341 Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can abuse the handler as a decryption oracle to recover the full...

CVE-2026-91770

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

EUVD-2026-78246

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

CVE-2026-91770

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints (skill, education, certification, language, leave, attendance, and status), allowing any authenticated employee to substitute arbitrary employee IDs and read colleagues' HR records. The vulnerability is...

CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

EUVD-2026-78158

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers...

PT-2026-93190

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan config set cgi, wan num set cgi, and lan ip change cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network...

PT-2026-92050

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4 Description Insufficient tenant isolation in the enterprise organization and workspace membership APIs allows authenticated users to provide arbitrary organization IDs. This flaw enables attackers to add...