CVE-2026-92782 Chroma through 1.5.9 Authorization Bypass via Collection Identifier

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests...

CVE-2026-92781 Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...

CVE-2026-92780 KnowStreaming through 3.4.1 Missing Authorization on the REST API

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-92779 Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...

CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

CVE-2026-92776 Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

CVE-2026-92775 Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-92774 Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-92772 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to depl...

CVE-2026-92771 Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92765 ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles,...

CVE-2026-92764 OpenCVE 2.4.0 < 3.1.0 Organization API Ignores Token Scope

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92763 Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths tha...

CVE-2026-92761 WebVirtCloud Missing Authorization on Instance Control Actions

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the getinstance gate...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92754 PatrowlManager through 1.8.4 Improper Access Control via users API

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...

CVE-2026-92759 SecObserve before 1.59.1 Information Disclosure via API Configuration

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basicauthpassword field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or...

CVE-2026-92753 PatrowlManager through 1.8.4 Authorization Bypass via Events API

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users...

CVE-2026-92751 CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

CVE-2026-92752 metasfresh Unauthorized Access via Document Attachments and Comments Endpoints

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role...

CVE-2026-92750 Harness through 3.3.0 Missing Access Control via infraproviders endpoint

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...

CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92748 BC Security Empire before 6.7.1 Path Traversal File Upload RCE

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-63506 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app...

CVE-2026-76426 Cisco ISE REST API SQL Injection Vulnerability

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

CVE-2026-20121 CIsco FTD Bypass Access List

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-76431 Cisco Identity Services Engine Arbitrary File Deletion Vulnerability

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid...

CVE-2026-76427 Cisco ISE XML External Entity Injection Vulnerability

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...

CVE-2026-76447 Cisco Identity Services Engine Certificate Reload Vulnerability

A vulnerability in the Online Certificate Status Protocol OCSP responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a...

CVE-2026-20287 Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20285 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-20286 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-76438 Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-20072 ISE information disclosure

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to. This vulnerability exists because certain files lack proper...

CVE-2026-76446 Cisco Identity Services Engine External Entity Injection Vulnerability

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit th...

CVE-2026-20071 ISE 802.1x Session Hijack Vulnerability

A vulnerability in the SSID bring-your-own-device BYOD onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are...

CVE-2026-20300 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of...

CVE-2026-76432 Cisco Identity Services Engine Arbitrary File Write Vulnerability

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-76448 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76434 Cisco Identity Services Engine Arbitrary File Read Vulnerability

A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read arbitrary files from the affected system. To exploit this vulnerability, the attacker must have valid administrative...

CVE-2026-20120 Cisco FTD ACL bypass vulnerability

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-76444 Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table PRRT service. A...

CVE-2026-20235 Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in the API of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient...

CVE-2026-20290 Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability

A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart. This vulnerability is due to incomplete validation of the SSL...

CVE-2026-76451 Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76449 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76450 Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...