CVE-2026-114066 Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST...

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST...

CVE-2026-114066 Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST...

CVE-2026-114059 ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST...

CVE-2026-114058 ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

CVE-2026-114058 ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

CVE-2026-114058 ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

CVE-2026-114058

ArcadeDB versions 26.2.1 before 26.10.1 are vulnerable to a missing authorization flaw in the Bolt protocol handler . This vulnerability allows authenticated users to access and read schema metadata for other databases. Specifically, an attacker with credentials for a single database can manipula...

EUVD-2026-107009

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...

EUVD-2026-107008

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal...

CVE-2026-114057 ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal...

PT-2026-120574

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

PT-2026-120655

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

PT-2026-120670

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

PT-2026-120609

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in the built-in cluster expansion functions gp expand lock catalog and gp expand bump version. Any authenticated database role can run them, and neither checks privileges. ...

PT-2026-120610

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gp add coordinator standby. The function is named gp add master standby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove...

PT-2026-120577

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get users by group course, user by all roles,...

PT-2026-120183

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal...

PT-2026-120571

Name of the Vulnerable Software and Affected Versions SchedulePress versions prior to 5.3.5 Description An authorization flaw exists that allows authenticated users with Contributor-level permissions to modify the status and publish date of any post. This is possible due to a missing capability...

JetBrains YouTrack < 2026.2.19575 / 2026.3.x < 2026.3.16075 Missing Authorization (CVE-2026-111092)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.19575, or 2026.3.x prior to 2026.3.16075. It is, therefore, affected by a missing authorization vulnerability: - In JetBrains YouTrack before 2026.2.19575, 2026.3.16075, 2026.3.16397, 2026.3.16402 mail rules allowed...