CVE-2026-109188

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or...

CVE-2026-109188

The jshERP software, through version 3.6 , is vulnerable to a missing authorization vulnerability (CWE-862). This flaw allows low-privilege authenticated users to bypass role checks and create tenant-wide master data by sending POST requests to specific endpoints. Affected endpoints include /acco...

CVE-2026-48088

OpenReception’s OpenReception appointment-booking software (prior to version 1.0.4) is vulnerable to unauthenticated crypto key provisioning via POST /api/tenants/{tenantId}/staff/{staffId}/crypto, allowing attacker-controlled ML-KEM-768 public keys to be registered for any tenant. The handler lo...

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Summary /api/public/v1/roles/assign is guarded by the builderOrAdmin middleware, which passes any user who is a builder for the app id in the x-budibase-app-id header. That check admits both global builders and workspace-scoped builders builder.apps set but builder.global unset. The controller th...

PT-2026-3085

Name of the Vulnerable Software and Affected Versions Agentflow versions affected versions not specified Windows Admin Center versions affected versions not specified Description Agentflow, developed by Flowring, exhibits a Missing Authentication issue. This allows unauthenticated remote attacker...