CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

EUVD-2026-97887

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564

LearnHouse versions prior to 1.4.0 are susceptible to a missing authorization vulnerability (CWE-862) within the POST /api/v1/playgrounds/{uuid}/duplicate endpoint. The flaw occurs because this endpoint bypasses the read-access and draft checks typically enforced by get_playground. Consequently, ...

EUVD-2026-97885

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

CVE-2026-109562

Versions 1.15.10 through 2.2.0 of SnapOtter are vulnerable to a missing authorization flaw. This allows any authenticated principal to access the /api/v1/upload , /api/v1/preview , and /api/v1/preview/generate handlers without proper permission checks. An attacker with a low-privilege settings:re...

EUVD-2026-97875

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call getbatchqty, getbatchesbyoldest or getposreservedbatchqty to list every item...

CVE-2026-109377

ERPNext versions 9.0.0 through 16.50.0 are affected by a missing authorization vulnerability (CWE-862). The issue allows authenticated users, such as customer portal users, to access sensitive stock information by calling specific whitelisted batch methods: get_batch_qty , get_batches_by_oldest ,...

CVE-2026-109377 ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call getbatchqty, getbatchesbyoldest or getposreservedbatchqty to list every item...

CVE-2026-109377 ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call getbatchqty, getbatchesbyoldest or getposreservedbatchqty to list every item...

CVE-2026-84314

Nginx UI, a web user interface for the Nginx web server, is vulnerable to Account Takeover in versions prior to 2.4.1 . The POST /api/users/:id user-management endpoint fails to enforce the RequireSecureSession step-up, which is otherwise required for self-service password changes. An attacker wi...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.5.0 , the application fails to apply the RequireSecureSession middleware to several sensitive mutation routes, including the api/cluster router. This allows an authenticated user with a stolen or persisted JWT to bypass...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-92116

Apache Allura versions through 1.21.0 are vulnerable to an OAuth1 callback validation issue, categorized under CWE-601 (URL Redirection to Untrusted Site). This flaw allows for potential open redirect consequences due to missing validation during the OAuth1 callback process. Impacted users are re...

CVE-2026-92116 Apache Allura: OAuth1 missing callback validation

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

CVE-2026-108921

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysqlquery of the file removeannouncements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missi...

CVE-2026-57118

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /path/list, POST /path, and POST /path/agentid' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let...