PT-2026-70843

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

PT-2026-70206

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content title, description, and attachments of tickets belonging to another company, to hijack another company's...

PT-2026-70115

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...

PT-2026-70264

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

PT-2026-70052

Name of the Vulnerable Software and Affected Versions Chiline Cloud affected versions not specified Description Chiline Cloud developed by Inventec Appliances contains an Insecure Direct Object Reference IDOR issue. This occurs when an application provides direct access to objects based on...

PT-2026-70254

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

CVE-2026-72876 Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and...

CVE-2026-72876 Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and...

CVE-2026-72737

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that...

CVE-2026-72737 Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that...

CVE-2026-72737

Dokploy (free self-hosted PaaS) vulnerability CVE-2026-72737 affects 0.29.8 and earlier. The flaw is in backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts, which accept a client-controlled destinationId and use the referenced destination wi...

CVE-2026-72737

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that...

CVE-2026-72737 Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that...

CVE-2026-72734

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer...

CVE-2026-72724

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...

CVE-2026-72724

Discourse vulnerability CVE-2026-72724 affects the chat onebox flow. Prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before verifying preview permissions, allowing ...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

PT-2026-69879

Name of the Vulnerable Software and Affected Versions Dokploy versions 0.28.7 through 0.29.12 Description The server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and executes the functions haveActiveServices, findServerById,...

CVE-2026-48169

CVE-2026-48169 (PraisonAI Platform) has concrete cross-workspace IDOR and privilege-escalation flaws. The API routes enforce workspace membership but the service layer (in IssueService and ProjectService) performs global primary-key lookups (e.g., get/update/delete) without filtering by workspace...