EUVD-2026-103288

Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser pkg/models/projectaccess.go, which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write...

EUVD-2026-103308

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to...

EUVD-2026-103331

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWSDELETE instead of NEWSEDIT. Attackers holding addnews and delnews can read the...

CVE-2026-111912

Admidio versions 5.0.0 before 5.0.16 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the ForumService::saveTopic() function. This vulnerability allows authenticated members to modify forum topics belonging to other users by replacing the topic_uuid parameter in a topic_sa...

CVE-2026-111908

The phpMyFAQ software (versions 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta ) is vulnerable to a broken object-level authorization (BOLA) flaw in the PUT /api/v3.1/faq/update endpoint. The root cause is that the application verifies the global edit_faq permission but fails to validate if...

CVE-2026-111888

The phpMyFAQ software (versions 4.0.0 before 4.1.9 ) is vulnerable to an incorrect authorization flaw in the news update API. The root cause is that the PUT /admin/api/news/update endpoint incorrectly validates the NEWS_DELETE permission instead of the required NEWS_EDIT right. Consequently, dele...

nfcgate

NFCGate ⚠️NFCGate is currently being falsely detected as "NGate" malware. Please seethis issue for up-to-date information.⚠️ NFCGate is an Android application meant to capture, analyze, or modify NFC traffic. It can be used as a researching tool to reverse engineer protocols or assess the security...

frida-ios-hook

Frida iOS hook 📍 A tool that helps you can easy using frida. It support script for trace classes, functions, and modify the return values of methods on iOS platform. 👉 For Android platform: frida-android-hook 👉 For Intercept Api was encrypted on iOS application: frida-ios-intercept-api Env OS...

EUVD-2026-103222

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wi...

FineCMS <5.0.9 - Open Redirect

FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...

CVE-2026-111716

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111665

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

CVE-2026-111657

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/id/markasshipped endpoint to...

CVE-2026-111645

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sortdata document ids to publish private drafts and reparent...

CVE-2026-111611

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111604

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to...

CVE-2026-111716 Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

EUVD-2026-103008

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111716

The Arkon software (through version 0.9.2 ) is susceptible to a broken access control vulnerability in the app/routers/sources.py file. The root cause is that by-id routes fail to call the can_access_document function, allowing authenticated employees to bypass permissions. Exploitation allows an...

CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...