CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

EUVD-2026-81045

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests...

EUVD-2026-81019

Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app...

CVE-2026-90936

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-6355

Augmentt: Acceso entre inquilinos mediante IDOR Créditos Este CVE fue un esfuerzo colaborativo entre: Raznov – GitHub: https://github.com/basraznov HelloWorld Autor– GitHub: https://github.com/Penquinsecq Descripción Una vulnerabilidad en la aplicación web permite a usuarios no autorizados accede...

CVE-2026-23552

CVE-2026-23552 - Aceptación de tokens entre reinos en camel-keycloak Resumen La KeycloakSecurityPolicy de Apache Camel no valida la reclamación iss emisor de los tokens JWT contra el reino configurado. Esto significa que un token emitido por un reino de Keycloak es aceptado silenciosamente por un...

CVE-2026-88007

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...

CVE-2026-67403

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier...

EUVD-2026-75060

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier...

CVE-2026-67403

Cash Collect (Sage) has an improper authorization vulnerability in the Sage AR Automation API . Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non-predictable tenant identifier. The CVSS ...

CVE-2026-19625

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

CVE-2026-19625 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

GHSA-848M-R628-VRXW SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

An authenticated user scoped to one namespace/database could invoke a custom API DEFINE API belonging to a different namespace/database, reaching another tenant's endpoint. The route /api/namespace/database/endpoint took the namespace and database from the URL and applied them to the caller's...

EUVD-2026-45906

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path...

CVE-2026-85697

Documenso 2.17.0 contains an access control flaw in its PDF-serving endpoint . The route fails to validate document visibility settings, specifically missing ownership validation on document data identifiers , allowing attackers with low privileges to read restricted documents within their team o...

CVE-2026-85697 Documenso 2.17.0 PDF Route Ignores Document Visibility

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

CVE-2026-85615

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85611

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

EUVD-2026-70666

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

CVE-2026-85389 Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...