CVE-2026-9808

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints utilizing API Platform. Under certain conditions, roles configured with owner-scope restrictions such as viewown or editown are not properly enforced. This allows low-privilege authenticated API users to bypass...

GHSA-M98R-6667-4WQ7 Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)

Impact Aegra deployments running 0.9.0 through 0.9.6 with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated user User A, given another user's threadid User B, can: - Execute graph runs against User B's thread via POST /threads/threadid/runs...

CVE-2026-6542

IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flowid to read transaction logs and vertex build data belonging to other users, and to delete persisted vertex build data for another user's flow...

EUVD-2025-37752

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id' and ' 'idsociedad' in '/api/buscarEmpresaById.php'...

CVE-2022-36539

WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children...

Parallel overstepping vulnerability in Liangjing Mall online store shopping system

Liangjing Mall Online Shop Shopping System is a set of multi-functional online store system that can be suitable for different types of commodities, super flexible, three-tier distribution PC+Mobile+Micro-site. There is a parallel override vulnerability in LiangJing Mall Online Shop Shopping...

CVE-2018-15405

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly...

Coremail's Android version suffers from an override access vulnerability.

Coremail Lobbyist Email System for Android is a mobile email app. There is an over-authorized access vulnerability in the "Personal Details" page of Coremail Lonker Mailbox System for Android. It allows attackers to utilize the vulnerability to modify the list field to query the name, cell phone...