SolarWinds Serv-U 15.5.4 < 2026.3 Multiple Vulnerabilities XSS

The version of SolarWinds Serv-U installed on the remote host is prior to 2026.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsserv-u20263 advisory. - SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead...

PT-2026-62413

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

PT-2026-61877

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A privilege escalation issue exists within the DOM: Workers component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

PT-2026-61894

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the DOM: Service Workers component. Service Workers are scripts that the browser runs in the background, separate from a web page,...

CVE-2026-47419: Authorization Bypass Through User-Controlled Key

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into plain containers...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into...

GHSA-7Q8Q-RJ6J-MHJQ Axios: Nested axios option objects can consume polluted prototype values

Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinar...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in...

CVE-2026-47130

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...

CVE-2026-47130

NextCRM contains a BOLA/IDOR in the PATCH /api/crm/contacts/[id] endpoint. Versions prior to 0.12.0 do not verify resource ownership, allowing any authenticated user (even with member role) to modify contacts/targets belonging to other users or organizations (cross-tenant data tampering). The iss...

EUVD-2026-46108

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-47130

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-47130 NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-47130 NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 expose an Insecure Direct Object Reference (IDOR) in the /v1.3.0/api/files endpoint. An authenticated attacker can modify the remark parameter to enumerate, access, and delete files owned by other users, impacting confidentiality, integrity, and availability. Root...

EUVD-2026-46093

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...