CVE-2026-30971 ZoneMinder: Authenticated RCE via command injection in monitor Device Path

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-59966 Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub without complexity validation or an execution timeout when an authenticated user stores a...

CVE-2026-59963 Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies...

CVE-2026-17068 IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag...

CVE-2026-17275 IBM i is Affected by an Improper Validation Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers...

CVE-2026-85231 Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

CVE-2026-109838 IBM Db2 Genius Hub Improper verification of cryptographic signature

IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature...

CVE-2026-111721 Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces authwarehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on...

CVE-2026-111718 AipexBase through commit 690adb9 SQL Injection via /api/data/invoke

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

CVE-2026-111716 Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip canaccessdocument. Attackers can call the plan, progress, PATCH, retry and approve-extraction...

CVE-2026-111711 Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's userok function, which copies Basic-auth usernames with unbounded strcpy calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to an...

CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all...

CVE-2026-111707 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values...

CVE-2026-111706 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

CVE-2026-111702 ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...

CVE-2026-111703 yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints

yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details,...

CVE-2026-111701 OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/bucketId/path is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pat...

CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...

CVE-2026-111697 HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

CVE-2026-111688 Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire...

CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint

WeRSS we-mp-rss through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/feedid endpoint. Attackers can supply a non-built-in ext value and a =expression template whose object-subclass traversa...

CVE-2026-111682 EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...

CVE-2026-111673 IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/ is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any...

CVE-2026-111662 Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,...

CVE-2026-111657 BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/id/markasshipped endpoint to...

CVE-2026-111652 Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/ paths for .jpg, .png, .bmp, or .mp4 files, which are...

CVE-2026-111647 PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}

PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET...

CVE-2026-111646 SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/attachmentId. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks i...

CVE-2026-111642 FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation

FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token...

CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...

CVE-2026-111637 NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

CVE-2026-111632 Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or...

CVE-2026-111631 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

CVE-2026-111627 HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOTUSER administrators to perform write actions while impersonating the protected ROOTUSER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never...

CVE-2026-111622 smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem...

CVE-2026-111617 WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

CVE-2026-111612 netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the...

CVE-2026-111611 roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111607 Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the...

CVE-2026-111606 Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person,...

CVE-2026-111392 SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

SGLang through 0.5.21 trusts caller-supplied mmhashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or...

CVE-2026-109839 IBM Db2 Genius Hub Missing Cryptographic Step

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm...

CVE-2026-102693 RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's atwinc15x0stasetcurrentssid function uses strcpy to copy an SSID without checking the destination size. When...

CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on...

CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's

MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYSREFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYSREFCURSORs and then fetch...

CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STAsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for...

CVE-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-86008 Mailu domain managers can take over higher-privileged accounts

Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure...