CVE-2026-108553: Cross-Site Request Forgery (CSRF)

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108656: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve...

CVE-2026-108607: Authorization Bypass Through User-Controlled Key

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...

PT-2026-109868

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An insecure direct object reference issue allows authenticated users to delete AI video generation records belonging to other users. This is achieved by providing arbitrary userId values to the...

Linux Distros Unpatched Vulnerability : CVE-2026-108553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet...

PT-2026-109938

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can retrieve the stored password values of any user due to missing authorization in the GET '/sys/api/getUserByName' endpoint. An attacker can use the hard-coded...

PT-2026-109870

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An insecure direct object reference allows authenticated users to access the AI voice generation history of other users. By manipulating the userId parameter in the GET '/airag/voice/listByUser'...

PT-2026-109917

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysTenantController within the GET '/sys/tenant/getTenantPackApplyUsers' endpoint. This issue allows any authenticated user to access tenant administrator...

PT-2026-109869

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An insecure direct object reference issue allows authenticated users to delete AI voice records belonging to other users. By providing an arbitrary userId to the DELETE...

PT-2026-109896

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysDepartController within the GET '/sys/sysDepart/getDepartmentHead' endpoint. This issue allows any authenticated user to list department staff by enumerating...

PT-2026-109662

Name of the Vulnerable Software and Affected Versions AstronRPA versions prior to 1.1.7 Description The robot-service lacks a tenant authorization check, allowing authenticated users to access shared variables belonging to other tenants. This is possible through the 'get-batch-shared-var' endpoin...

CVE-2026-108581: Missing Authorization

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

PT-2026-109672

Name of the Vulnerable Software and Affected Versions TencentCloud Octop versions prior to 1.0.2b6 Description A missing authorization issue allows authenticated users with low privileges to access stored provider API keys. By querying the 'GET /api/providers' and 'GET /api/voice/providers'...

CVE-2026-108654: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

PT-2026-109914

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryPageList handler of the OpenApiController. This allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can access the...

PT-2026-109893

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the SysDepartPermissionController. This issue allows any authenticated user to access department permission records. An attacker with low...

PT-2026-109667

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.10.2 Description A cross-site request forgery CSRF flaw exists in the get-rows command. This issue allows remote attackers to lure a user to a malicious page that issues a cross-origin GET request with a crafted...

CVE-2026-108635: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars,...

CVE-2026-108677: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

CVE-2026-108594: Server-Side Request Forgery (SSRF)

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...