EUVD-2026-96593

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-108654 JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-108654

JeecgBoot versions up to and including 3.9.5 are affected by a missing authorization vulnerability in the OssFileController queryById handler. This flaw allows low-privileged authenticated users to access records belonging to other users by requesting GET /sys/oss/file/queryById with a known reco...

PT-2026-109915

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the OssFileController. Low-privileged authenticated users can access object storage file records by sending a request to the 'GET...

CVE-2026-108654: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-44654

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file records through DELETE /api/files that the owner has reused across multiple agents. The deletion removes the file globally — not just from the...

CVE-2026-44654

CVE-2026-44654 (LibreChat) : In versions up to 0.8.3, a shared-agent editor can issue DELETE /api/files to remove file records that a user has reused across multiple agents. The deletion is global, not limited to the shared agent, which can break the owner’s other private agents that reference th...

CVE-2026-31716 fs/ntfs3: validate rec->used in journal-replay file record check

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec-used in journal-replay file record check checkfilerecord validates rec-total against the record size but never validates rec-used. The doaction journal-replay handlers read rec-used from disk and use it to...