CVE-2026-107674 IBM i is Affected by a Denial of Service in Digital Certificate Manager

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager DCM for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections...

CVE-2026-109838 IBM Db2 Genius Hub Improper verification of cryptographic signature

IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature...

CVE-2026-89098 Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an...

CVE-2026-111723 LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

CVE-2026-111722 LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id ...

CVE-2026-111721 Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces authwarehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on...

CVE-2026-111720 fish-island-backend through commit 7c61b78 SSRF via /api/web/parse

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...

CVE-2026-111718 AipexBase through commit 690adb9 SQL Injection via /api/data/invoke

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

CVE-2026-111719 Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query

Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain th...

CVE-2026-111717 Arkon through 0.9.2 Missing Authorization via Skills Versions API

Arkon through 0.9.2 contains a missing authorization vulnerability in listskillversions that allows authenticated employees to read other departments' skill version metadata by bypassing the canaccessskill check. Attackers holding the default skill:read permission can request GET...

CVE-2026-111716 Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111715 Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:owndept permission can query getneighborhood without scope checks to obtain...

CVE-2026-111714 tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...

CVE-2026-111712 Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix

Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7webauth.cgi or an .ico route to invoke protecte...

CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111711 Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's userok function, which copies Basic-auth usernames with unbounded strcpy calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to an...

CVE-2026-111710 Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's userauth function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as on...

CVE-2026-111709 WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...

CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

CVE-2026-111707 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values...

CVE-2026-111706 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

CVE-2026-111705 Fuint through commit 57ec018 IDOR via bookId in myBookDetail

Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contac...

CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys...

CVE-2026-111703 yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints

yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details,...

CVE-2026-81452

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service...

CVE-2026-111702 ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...

CVE-2026-111701 OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/bucketId/path is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pat...

CVE-2026-111699 Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...

CVE-2026-111700 WebVella ERP through 1.8.8 SQL Injection via EQL Query API

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/enUS/eql, escaping the unsanitized EqlBuilder SQL...

CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...

CVE-2026-111697 HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

CVE-2026-111696 data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

CVE-2026-111694 qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...

CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111689 XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/departmentId with arbitrary department ids to retrieve usernames,...

CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

CVE-2026-111688 Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-111686 IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract...

CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint

WeRSS we-mp-rss through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/feedid endpoint. Attackers can supply a non-built-in ext value and a =expression template whose object-subclass traversa...

CVE-2026-111685 IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last to extract databa...

CVE-2026-111684 Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service

Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or...

CVE-2026-111682 EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

CVE-2026-111683 Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and...

CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...

CVE-2026-111679 Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...

CVE-2026-111680 APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services...

CVE-2026-111678 Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiwor...