PT-2026-110134

Name of the Vulnerable Software and Affected Versions Raven versions 2.0.0 through 3.0.0 Description Authenticated users with the Raven User role can bypass the can only join via invite setting to join invite-only Public workspaces. This is achieved by calling the join workspace method, allowing...

CVE-2026-108705: Missing Authorization

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

CVE-2026-108868: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

PT-2026-109983

Name of the Vulnerable Software and Affected Versions Wukong AICRM versions prior to 20260611 Description An authorization flaw allows authenticated users to write into the AI chat sessions of other users. By providing an arbitrary sessionId to the 'POST /chat/send' endpoint, an attacker can appe...

PT-2026-109982

Name of the Vulnerable Software and Affected Versions Eladmin versions prior to 2.8 Description Low-privileged authenticated users can bypass the storage:add permission due to missing authorization in the uploadPicture handler of the LocalStorageController. By sending POST requests containing fil...

CVE-2026-108851: Missing Authorization

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

CVE-2026-108708: Missing Authorization

WukongHRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards an...

CVE-2026-108872: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

PT-2026-110120

🚨 CVE-2026-108717 Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and...

CVE-2026-108713: Missing Authorization

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId,...

CVE-2026-88905: Improper Neutralization of Input During Web Page Generation

The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...

CVE-2026-108756: Missing Authorization

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...

PT-2026-109992

Name of the Vulnerable Software and Affected Versions 1Panel-dev CordysCRM versions prior to 1.9.2 Description An authorization flaw exists in the sortModule handler within the ContractController. The endpoint 'POST /contract/sort' lacks necessary permission annotations, allowing authenticated...

PT-2026-110116

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.x through 7.15.2 SuiteCRM versions 8.x through 8.10.2 Description Authenticated users can create and modify EmailMarketing records due to missing authorization. Low-privileged users who are denied access to Campaigns can us...

CVE-2026-108855: Missing Authorization

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other...

CVE-2026-108726: Missing Authorization

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contrac...

PT-2026-110208

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryChildrenByUsername handler within the 'SysUserController'. This issue allows any authenticated user to retrieve account records of other users. By providing...

PT-2026-110205

🚨 CVE-2026-108883 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of...

PT-2026-110158

Name of the Vulnerable Software and Affected Versions Abilityai Trinity versions prior to 0.9.6 Description A missing authorization issue exists in the Telegram router. This allows agent-scoped MCP API keys to execute binding operations that should be restricted to humans. An attacker who gains...

PT-2026-110165

Name of the Vulnerable Software and Affected Versions CoreShop versions prior to 2026.2.3 Description Low-privileged backend users can list permission-restricted resources due to a missing authorization check in the listAction function of the ResourceController. Authenticated Pimcore users withou...