CVE-2026-104961

The open-source project management tool Plane is vulnerable to an incorrect authorization issue (CWE-863) prior to version 1.4.0 . The WorkspaceOwnerPermission check fails to verify if a user's is_active status is set to True. Consequently, a deactivated user can retain owner-level access to a wo...

CVE-2026-104960

The project management tool Plane contains an authorization bypass in the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint. Prior to version 1.4.0 , the application fails to enforce project-level access controls for project-bound FileAsset objects. Con...

CVE-2026-104956

The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...

CVE-2026-105382

The onetwothreeneth HospitalManagementSystem is vulnerable to improper authorization in the Account Administration component. Specifically, a flaw in the update_subaccount function within the php/controller.php file allows for the manipulation of the user_id argument. This vulnerability enables r...

CVE-2026-104955

The open-source project management tool Plane is vulnerable to Broken Access Control and Privilege Escalation prior to version 1.4.0 . An attacker with a Project Member role (role 15) can send a PATCH request to the /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ endpo...

CVE-2026-104894

The open-source project management tool Plane is vulnerable to a cross-tenant issue linking flaw via an IDOR (Insecure Direct Object Reference) vulnerability in versions prior to 1.4.0 . The modules endpoint fails to validate that issue UUIDs provided in the URL path belong to the caller's worksp...

CVE-2026-104893

The project management tool Plane is vulnerable to improper validation in its API. Prior to version 1.4.0 , an authenticated user can use the PATCH /api/users/api-tokens/{token_id}/ endpoint to modify the allowed_rate_limit field without server-side validation or a maximum limit. This allows an a...

CVE-2026-12171

Versions of auto-changelog prior to 2.6.1 are vulnerable to code execution , argument injection , path traversal , and SSRF because they process untrusted configuration from within the target repository (e.g., .auto-changelog or package.json). Specifically, the handlebarsSetup option is passed to...

CVE-2026-86671

In Eclipse Che versions 7.29.0 and later , the GET /api/scm/resolve and POST /api/factory/resolver endpoints are vulnerable to Server-Side Request Forgery (SSRF) . The application passes attacker-controlled URLs to URLFetcher.fetch() without an allow-list for schemes or hosts. Consequently, an au...

CVE-2026-102779

The Joomla Extension - joomlafry.com (TF Content) versions 2.9.0 through 2.9.4 is vulnerable to unauthenticated forced execution of published automation tasks. The component fails to enforce authentication, ACL, CSRF, task-trigger, content-binding, or cron-token protections on the records.custom_...

CVE-2026-102777

The Joomla Extension - svenbluege.de Event Gallery extension (versions

CVE-2026-102426

The SP Page Builder Pro Joomla extension by joomshaper.com is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the Dynamic Content Filter addon, specifically affecting versions 3.0.0 - 5.6.1p2 . The root cause is the improper handling of the dc_filter_ request parameter; while the sli...

CVE-2026-102778

The Joomla Extension - svenbluege.de (Event Gallery extension) is vulnerable to Cross-Site Scripting (XSS) and Open Redirect in versions prior to 6.6.0 . When the "Share article links" option is enabled, the share mini page takes the article address from a shared link and prints it into the page ...

CVE-2026-102780

The Joomla Extension - joomlafry.com - TF Content (versions 2.9.0 - 2.9.4 ) is vulnerable to unauthenticated cross-record publication and mass assignment . The root cause is that the public RecordController unconditionally authorizes both creation and editing actions. Additionally, the shared fro...

CVE-2026-102776

The Joomla Extension - svenbluege.de 's Event Gallery extension (versions

CVE-2026-102775

The Joomla Extension - phoca.cz (specifically Phoca Cart versions 5.0.0 - 6.1.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the order-file download endpoint. The application fails to validate provided d (download token) and o (order token) parameters against stored value...

CVE-2026-102428

The OrdaSoft Joomla CCK extension (versions

CVE-2026-104892

The open-source project management tool Plane is vulnerable to sensitive information disclosure in versions prior to 1.4.0 . The aPITokenLogMiddleware component incorrectly logs API keys in plaintext , which could allow an attacker with low privileges to steal user API keys and escalate their pri...

CVE-2026-104891

The @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate packages are vulnerable to an authentication bypass where the software grants free-access receipts based on a wallet address provided in the client-supplied credential.source. The underlying cause is that the system fails to ...

CVE-2026-104890

Kunstmaan CMS , a Symfony-based content management system, contains a blacklist bypass vulnerability in the MediaBundle extension (specifically in src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php). Prior to version 7.3.2 , the FileHandler::getFilePath function performs a case-sensitive check...