EUVD-2026-102970

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...

CVE-2026-111679 Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...

CVE-2026-111679 Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...

CVE-2026-111679 Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...

CVE-2026-111679

Ekko Studio versions through 0.7.36 are vulnerable to a missing authorization flaw in the /api/auth/locked-ips endpoint. This allows any authenticated non-super_admin user to list and clear server-wide login lockouts. Specifically, an attacker can send a DELETE request without an IP parameter to ...

CVE-2026-111679

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...

CVE-2026-111674 Tbed through 20240319 Missing Authorization via setImgFileName Endpoint

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names wi...

CVE-2026-111674

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names wi...

EUVD-2026-102965

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names wi...

CVE-2026-111674 Tbed through 20240319 Missing Authorization via setImgFileName Endpoint

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names wi...

CVE-2026-111674

The software Tbed (versions through 20240319 ) is vulnerable to a missing authorization flaw in the /admin/setImgFileName endpoint. This vulnerability allows any authenticated user to rename images belonging to other users. An attacker can provide a victim's imgname—which is often exposed in publ...

CVE-2026-111674 Tbed through 20240319 Missing Authorization via setImgFileName Endpoint

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names wi...

EUVD-2026-102963

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

CVE-2026-111672

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

EUVD-2026-102961

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670

ClickVisual versions through 1.1.2 are vulnerable to a missing authorization (CWE-862) flaw within the /api/v2/reports handlers. This security weakness allows authenticated users with low privileges to access ClickHouse instances they are not authorized to view. By iterating the instance-id param...