87359 matches found
CVE-2026-100371
The self-hosted open source application InvoicePlane (version 1.7.2) contains an incomplete authorization remediation that allows a secondary administrator to achieve full account takeover of the primary administrator (user_id=1). The vulnerability exists because while direct password changes are...
CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...
PT-2026-102342
Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2 Description In the Users::form function, the application fails to perform an object-level authorization check on the user id variable when it is set to 1. This allows a Secondary Administrator to change the Primary...
PT-2026-102341
Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description An authorization flaw exists where a secondary administrator can take over the primary administrator account. While a previous fix protected the Users::change password function, the Users::form...
CVE-2026-100392: Incorrect Authorization
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...
CVE-2026-100371: Incorrect Authorization
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...
CVE-2026-101089
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...
CVE-2026-101064 Obot before v0.23.0 Server-Side Request Forgery via MCP
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and clo...
EUVD-2026-88031
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and clo...
CVE-2026-101051
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-100861
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...
CVE-2026-100852
AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...
CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...
EUVD-2026-87820
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username
AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...
EUVD-2026-87836
AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell...
CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...
PT-2026-99294
🚨 CVE-2026-100623 Capgo capgo.app exposes the legacy membership table public.org users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization...
