414 matches found
CVE-2026-61728
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including customeruser, can submit stored markup through POST...
EUVD-2026-113993
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including customeruser, can submit stored markup through POST...
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...
GHSA-MP66-8WW2-PCWM GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe, and DATA frames are delivered without checking the protocol operation id Report metadata | Field | Value | | --- | --- | | Package |...
PT-2026-129187
Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function, the software reuses a single WebSocket and replaces its websocket.onmessage handler whenever a new overlapping subscription starts. T...
EUVD-2026-110516
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the projectid scope to...
CVE-2026-116808
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the projectid scope to...
CVE-2026-116808
OpenPanel versions prior to 3.0.0 are vulnerable to a ClickHouse SQL Injection flaw via the profile.values parameter. An authenticated user can provide a crafted property parameter to inject a SELECT expression with custom FROM and WHERE clauses. By commenting out the project_id scope, an attacke...
CVE-2026-116808 OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the projectid scope to...
CVE-2026-116808 OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the projectid scope to...
PT-2026-125514
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project id scope to...
CVE-2026-115334
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switchorganization/...
CVE-2026-115330
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...
EUVD-2026-108136
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switchorganization/...
CVE-2026-115334 Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switchorganization/...
CVE-2026-115334 Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switchorganization/...
CVE-2026-115334
Lotus versions through 0.10.2 are vulnerable to an authorization bypass within the ChangeUserOrganizationView.post function. By supplying a target organization's UUID in a POST request to /app/switch_organization/, an authenticated attacker can join any organization. This allows the attacker to a...
CVE-2026-115330
Lotus versions up to and including 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can execute arbitrary SQL by submitting semicolon-separated stacked statements via POST /app/metrics/ . This method bypasses first-statement-only validation, potentially al...
CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...
PT-2026-121368
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...