CVE-2026-100614

Capgo versions before 12.244.1 are vulnerable to a cross-tenant integrity issue within the metadata-cleaning worker . The root cause is that the worker trusts image object keys from mutable database rows without performing ownership validation. An authenticated attacker can exploit this by insert...

CVE-2026-100614 Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-96526

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

EUVD-2026-87538

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526

The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is susceptible to an authorization vulnerability. The root cause is a lack of object-level authorization checks on one of its workflow REST routes (specifically workflows/run). This flaw allows users with the Contributo...

EUVD-2026-87365

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-84460 Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

CVE-2026-84460 Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

CVE-2026-97060

X-SpringBoot versions through 6.0 are vulnerable to a broken object-level authorization flaw in user management endpoints. The root cause is a lack of ownership verification, allowing attackers with user-management permissions to perform unauthorized actions. Specifically, an attacker can reset p...

EUVD-2026-87254

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

EUVD-2026-87217

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new...

BIT-GITLAB-2026-87719 Deserialization of Untrusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

BIT-SEAWEEDFS-2026-58372 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...

BIT-RCLONE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-79179

A flaw was found in Chromium's Document Object Model DOM due to incorrect authorization. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could potentially lead to the leakage of sensitive information...

CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...