CVE-2026-121560

LogChimp versions 0.9.0-alpha.1 before 0.9.3 are vulnerable to an authorization bypass via the PATCH /api/v1/posts endpoint. The root cause is the handling of mismatched postId and id body parameters; an authenticated author can set postId to their own post while providing an enumerated victim po...

CVE-2026-121560 LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

EUVD-2026-114118

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713

Paperclip versions 2026.403.0 before 2026.416.0 are vulnerable to Remote Code Execution (RCE) due to an OS Command Injection flaw (CWE-78). Agent API key holders can utilize the PATCH /api/execution-workspaces/:id endpoint to set arbitrary cleanupCommand and teardownCommand values. When a workspa...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713: paperclipai @paperclipai/server: Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders…

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-89419

A flaw was found in OpenStack Ironic. A missing authorization check in the node PATCH API allows an authenticated lessee member to change the maintenance state of a bare metal node, an operation that should be restricted to lessee managers and administrators. By sending a PATCH request to...

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

PT-2026-120300

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

PT-2026-118588

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description The self-service password-change endpoint verifies the current password but fails to utilize the login module's failed-attempt counter, throttle, delay, or lockout mechanisms. An attacker with...

PT-2026-118500

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because th...

CVE-2026-77439

Summary Two related broken access control vulnerabilities in album member management allow any album Editor to: 1. Privilege escalation — promote themselves or any member to the Owner role via "PATCH /api/albums/:albumId/user/:userId" with ""role": "owner"" 2. Owner removal — delete any Owner-rol...

CVE-2026-112004

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

CVE-2026-112001

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...