PT-2026-111713

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

PT-2026-111552

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 10.0.7 Description An insecure direct object reference allows authenticated users with Import scope access to read attachments belonging to other users. This occurs when a foreign attachmentId is supplied to the Impor...

PT-2026-111716

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

PT-2026-111700

Name of the Vulnerable Software and Affected Versions RuoYi-Vue-Plus versions prior to 6.0.1 Description An insecure direct object reference allows authenticated users to delete social login bindings of other users. By sending a request to the endpoint "/auth/unlock/socialId" using a victim's...

PT-2026-111701

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes sys social rows by primary key without...

PT-2026-111721

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain...

PT-2026-112652

Name of the Vulnerable Software and Affected Versions DNS Server affected versions not specified Description An authorized attacker can execute arbitrary code over a network due to the release of an invalid pointer or reference. This issue allows remote attackers to affect the system...

PT-2026-111837

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

CVE-2026-102700: Undefined Security Weakness

With its original introduction, GNTTABcacheflush was made available uniformly. XSA-232 CVE-2017-14318 then covered an omitted NULL pointer check, yet the addition of that check failed to adjust the subsequent error path. That error path fails to drop a page reference in case the specified page is...

PT-2026-111719

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE...

PT-2026-111718

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/address...

CVE-2026-110113: Authorization Bypass Through User-Controlled Key

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

PT-2026-111645

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists in the GNTTAB cache flush function where a previously added NULL pointer check failed to correctly adjust the subsequent error path. This results...

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Large language model LLM agents are becoming an integral part of the software development lifecycle, and the capabilities granted to them allow an agent to act with the user's authority on any resource it can access. The reach that gives an agent its utility is equally available to an attacker wh...

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

CVE-2026-54640: Improper Restriction of XML External Entity Reference

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

CVE-2026-85362: Release of Invalid Pointer or Reference

Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally...

CVE-2026-18537

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template...

CVE-2026-18537 IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template...

EUVD-2026-97900

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template...