LiteLLM - Arbitrary File Read

LiteLLM 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts. id: CVE-2026-35029 info: name: LiteLLM - Arbitrary File Read...

EUVD-2026-88666

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or...

CVE-2026-8065

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or...

CVE-2026-47102-PoC

CVE-2026-47102 — LiteLLM Privilege Escalation via /user/update LiteLLM v1.83.7（v1.83.10 之前版本）的 /user/update 端点允许拥有该端点访问权限的 低权限用户在更新自己的账户时将 userrole 字段修改为 proxyadmin， 实现未授权的权限提升。 Field| Value ---|--- CVE| CVE-2026-47102 CVSS v3.1| 8.8 HIGH — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE| CWE-863 Incorre...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update 越权访问漏洞 Broken Access Control LiteLLM 的 /config/update 端点未检查调用者的角色权限 。任何持有有效 API Key 的已认证用户（无需管理员权限）均可修改代理配置，注册恶意 Pass-Through 端点以实现 环境变量窃取、任意文件读取、远程代码执行 等攻击。 Field| Value ---|--- CVE| CVE-2026-35029 CVSS v4.0| 8.7 HIGH —...

CVE-2026-77166

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...

CVE-2026-77166

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...

CVE-2026-77166

CVE-2026-77166 affects the emoji field in a web application's page emoji update endpoint , where improper input validation allows an authenticated user to inject long text and line breaks , breaking the sidebar layout and potentially hiding other items. The vulnerability is rated CVSS 3.0 2.4 (Lo...

CVE-2026-77166

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items...

PT-2026-96139

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Insufficient validation of user input in the emoji field of the page emoji update endpoint allows an attacker to inject long text and line breaks. This action...

CVE-2026-93504

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...

EUVD-2026-82904

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...

CVE-2026-93504 SveltyCMS User Attribute Update Endpoint +server.ts access control

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...

CVE-2026-93504

SveltyCMS 0.0.6 is affected by an improper access control flaw in the User Attribute Update Endpoint (file src/routes/api/[...path]/+server.ts). The vulnerability is exploitable over the network with low privileges and no user interaction, resulting in low impact to confidentiality, integrity, an...

CVE-2026-93504: Improper Access Control

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...

CVE-2026-47094

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

EUVD-2026-80933

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-82920

Mattermost versions 11.9.x ≤ 11.9.0 , 11.8.x ≤ 11.8.4 , and 11.7.x ≤ 11.7.7 fail to enforce authorization boundaries on the ABAC policy update endpoint. A channel or team administrator can detach a system-assigned ABAC parent policy by sending a crafted PUT /api/v4/access_control_policies request...