49683 matches found
PT-2026-96305
Name of the Vulnerable Software and Affected Versions Pagekit CMS versions prior to 1.0.19 Description An unauthenticated attacker can perform SQL injection, a technique used to manipulate database queries, by submitting a malicious credentials array to the public login endpoint 'POST...
CVE-2026-88756: Improper Neutralization of Special Elements used in an SQL Command
Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...
CVE-2026-79917: Improper Authorization
MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...
CVE-2026-58269: Authentication Bypass Using an Alternate Path or Channel
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns full access and refresh JWTs without checking whether the account has TO...
CVE-2026-61647: Improper Limitation of a Pathname to a Restricted Directory
NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batchtovault MCP...
CVE-2026-61744: Authorization Bypass Through User-Controlled Key
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...
CVE-2026-86802: Missing Authorization
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...
CVE-2026-94412: Missing Authorization
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value,...
CVE-2026-94414: Missing Authorization
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...
VulnCheck KEV: CVE-2026-88062
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...
CVE-2026-61628: Concurrent Execution using Shared Resource with Improper Synchronization
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...
CVE-2026-59830: Improper Neutralization of Input During Web Page Generation
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action...
PT-2026-96282
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.7.0 Description The post action component fails to escape user-controlled display names before they are interpolated into an HTML string passed to the trustHTML function. An attacker can set a crafted display...
PT-2026-96278
Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description In deployments using mixed local and SAML authentication, the UserModel.ssoLogin function returns an existing account matched by an Identity Provider IdP-asserted email without verifying the...
PT-2026-96262
Name of the Vulnerable Software and Affected Versions MaxKB versions 2.7.0 through 2.10.4-lts Description An issue exists where the system verifies the existence of a conversation but fails to confirm if it belongs to the authenticated chat user id or the application associated with the caller's...
PT-2026-96183
Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authorization flaw exists in the HandleWipeInventory function within the backend/app/api/handlers/v1/v1 ctrl actions.go file. The system authorizes the 'POST /v1/actions/wipe-inventory' endpoint...
PT-2026-96118
Name of the Vulnerable Software and Affected Versions nginx ignition versions prior to 2.41.1 Description An issue exists where the POST /api/users/onboarding/finish endpoint is accessible to unauthenticated users and allows the creation of an account with full ReadWrite admin permissions. The...
CVE-2026-36470
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php...
CVE-2026-55473: Server-Side Request Forgery (SSRF)
HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifierurl.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An...