CVE-2026-112294 FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

EUVD-2026-104279

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112293 BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293 BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293 BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112293

The BoxyHQ Enterprise SaaS Starter Kit through version 1.6.0 is vulnerable to a missing authorization vulnerability (CWE-862 ). The root cause is that specific payment routes fail to perform the team_payments permission check, allowing non-owner team members to manage billing. Authenticated users...

EUVD-2026-104280

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

EUVD-2026-104281

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112292

Versions of CheckCle through 1.6.0 are vulnerable to a missing authorization vulnerability (CWE-862) because the shipped PocketBase collections use empty API rules. This flaw allows unauthenticated attackers to query /api/collections//records endpoints to read, modify, or delete records. Potentia...

EUVD-2026-104311

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

CVE-2026-112262 RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

CVE-2026-112262 RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

CVE-2026-112262 RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

CVE-2026-112262

RisingWave versions before 3.1.0 are susceptible to a missing authorization vulnerability (CWE-862) involving posix_fs and fs connectors . Attackers with schema CREATE privileges can exploit this by setting posix_fs.root or fs.path to arbitrary directories. This allows low-privileged SQL users to...

CVE-2026-111938 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...

CVE-2026-111938 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...

CVE-2026-111938 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary callsid values. Attackers can call the addnotetocalllog and addtasktocalllog endpoints to attach attacker-written notes and tasks...