CVE-2026-7329

CVE-2026-7329 affects Progress MarkLogic Server REST interfaces (SQL, SPARQL, Optic). Before versions 11.3.6 and 12.0.3, an authenticated user with a low-privileged REST role can escalate to administrator, enabling privileged operations and unauthorized data access. Documented impact is high (cri...

EUVD-2026-53423

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged...

EUVD-2026-52816

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to denial of service and data tampering...

CVE-2026-47620

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to data tampering and denial of service...

CVE-2026-64631

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

CVE-2026-64630

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

CVE-2026-64630

Technical details (affected products, affected component, root cause, exact impact, or remedies) are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-52759

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

CVE-2026-64631

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

CVE-2026-64630

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

EUVD-2026-52757

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

CVE-2026-64631

CVE-2026-64631 describes an SQL injection vulnerability exploitable by a low-privilege user that can extract database contents. According to the provided metrics, the vulnerability has HIGH base severity (CVSS 4.0, score 8.5) with network attack vector, low attack complexity, and no user interact...

EUVD-2026-52726

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-69252

Flowise CVE-2026-69252: Before 3.1.3, the /api/v1/files route was protected only by feat:files and did not enforce checkPermission on GET/DELETE. A low-privileged, authenticated API key could list files under the organization root and delete files in other workspaces within the same organization ...

CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authenticated API key with unrelated permission...

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

CVE-2026-62927

Technical details for CVE-2026-62927 are not available in the provided connected documents; monitor for updates.

CVE-2026-16035

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

EUVD-2026-52513

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

EUVD-2026-52486

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...