CVE-2026-110124

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-108658 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full systenant records,...

CVE-2026-108658

JeecgBoot versions through 3.9.5 are susceptible to a missing authorization vulnerability (CWE-862) within the SysTenantController queryTenantAuthInfo handler. This flaw allows any authenticated user to access and read records belonging to other tenants. By iterating through small integer tenant ...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

BIT-KYVERNO-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-103054

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability within the MSSP module . This flaw allows authenticated users to submit tenant UUIDs via the add_tenants_to_portfolio endpoint, enabling them to claim unclaimed tenants and access sensitive data, including security alerts,...

PT-2026-102964

Name of the Vulnerable Software and Affected Versions AiSOC versions prior to 12.0.0 Description An authorization bypass exists in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. By submitting tenant UUIDs via the 'add tenants to portfolio' endpoin...

CVE-2026-92779

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...

CVE-2026-81540 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

CVE-2026-48074

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...

CVE-2026-48086

OpenReception’s appointment-booking software (pre‑1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...

CVE-2026-48077

OpenReception’s appointment-booking software exposes a specific GET endpoint that returns full appointment records without authorization prior to version 1.1.0. The affected path is GET /api/tenants/{id}/appointments/{appointmentId}, which can disclose tenant-scoped records, including channel and...

CVE-2026-45414 Decidim: JWT-backed authentication can be replayed across organizations

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

EUVD-2026-54224

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-48077: Missing Authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

PT-2026-68739

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.0 Description The GET handler at the endpoint /api/tenants/id/appointments/appointmentId fails to perform authorization checks. This allows any party with a valid appointment UUID to retrieve the full...

PT-2026-68735

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.4 Description The PIN-type challenge throttle uses emailHash as the sole key within a central challenge throttle table shared across all tenants. This shared architecture allows an attacker who knows a...

CVE-2026-48088: Missing Authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

CVE-2026-48078: Exposure of Sensitive Information to an Unauthorized Actor

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...