PT-2026-90870

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

CVE-2026-90565: Improper Access Control

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

GHSA-65XW-2V52-JHXC n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

NPM: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

EUVD-2026-75189

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-87922

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-87922 Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-87922 Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

PT-2026-89170

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument useri...

CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-86994

n8n , an open-source workflow automation platform, contained a missing userId filter that allowed cross-user information disclosure. The /rest/active-workflows endpoint returned every active workflow ID on the instance to any authenticated member regardless of sharing permissions, and lifecycle p...

CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...

CVE-2026-86262

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...

EUVD-2026-72239

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...

CVE-2026-86262

CVE-2026-86262 affects sfturing hosp_order (up to commit 627f426), an order-handling component in the file OrderController.java . The updateOrderdiseaseInfo function permits authorization bypass by manipulating the userID/id argument, allowing a remote, unauthenticated attacker to interfere with ...

CVE-2026-86262 sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...

CVE-2026-86262 sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...

PT-2026-86618

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions prior to 627f426331da8086ce8fff2017d65b1ddef384f8 Description An authorization bypass exists in the Order Handler component. A remote attacker can manipulate the userID or id arguments within the updateOrderSta1 an...

CVE-2026-86262: Authorization Bypass Through User-Controlled Key

A security vulnerability has been detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation ...