CVE-2026-108706

The eladmin framework (up to commit 55fbf70 ) is vulnerable to a missing authorization flaw in the downloadS3Storage handler. This allows any authenticated user to retrieve stored object URLs without the necessary storage permissions by enumerating sequential IDs against the GET /api/s3Storage/do...

CVE-2026-108707

The Wukong_HRM software (through commit 186115e ) is vulnerable to an authentication bypass within the ParamAspect component. By omitting the AUTH-TOKEN header, unauthenticated attackers can access every HRM API endpoint. This allows for unauthorized HR administrator access , enabling the reading...

CVE-2026-108705

CordysCRM through version 1.9.3 is vulnerable to a missing authorization flaw in the POST /custom-form/data/import endpoint. This vulnerability allows authenticated, low-privileged users to import data into any custom form by specifying a customFormId . Attackers can upload Excel files using impo...

CVE-2026-108704

CordysCRM through version 1.9.3 is affected by an authorization bypass vulnerability (CWE-639). Low-privileged authenticated users can bypass permission checks by setting the owner field to their own user ID. By sending requests to the follow/record/add endpoints, an attacker can add follow-up re...

CVE-2026-108703

CordysCRM versions through 1.9.3 are affected by a missing authorization vulnerability (CWE-862) within the POST /approval-resource/push endpoint. The root cause is a lack of ownership checks, which allows authenticated users to submit any resource for approval by supplying arbitrary resourceId v...

CVE-2026-108702

CordysCRM versions through 1.9.3 are vulnerable to a Blind SSRF due to a missing PROCESS_SETTING permission check on the POST /approval-flow/webhook/test endpoint. This flaw allows any authenticated user to trigger server-side requests to arbitrary URLs. Attackers can utilize a controlled host to...

CVE-2026-108701

1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw in the ContractController sortModule handler. The POST /contract/sort endpoint lacks necessary permission annotations, allowing authenticated users without contract update privileges to modify any contract b...

CVE-2026-108700

1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw (CWE-862) within the /field/source/business-title endpoint. Authenticated users can perform a POST request to this endpoint without the required CONTRACT_BUSINESS_TITLE_READ permission. Successful exploitati...

CVE-2026-108692

1Panel-dev CordysCRM versions 1.9.0 before 1.9.2 are vulnerable to a missing authorization vulnerability (CWE-862) within eight ModuleFieldController /field/source data-source endpoints. The root cause is a lack of proper permission checks, allowing authenticated users who are denied specific mod...

CVE-2026-108691

The mall4j platform, versions through 4.0 , is vulnerable to an improper authorization flaw caused by an operator precedence error in the cleanExpiryProdList SQL statement. This allows authenticated storefront customers to delete the cart items of other shoppers by sending a single DELETE request...

CVE-2026-108689

Wukong AICRM (versions through 20260610 ) is vulnerable to an authorization bypass (CWE-639) due to a missing authorization check on the POST /chat/send endpoint. This flaw allows an authenticated attacker to provide an arbitrary sessionId to write messages into another user's AI chat session. By...

CVE-2026-108690

Versions of mall4j through 4.0 are vulnerable to an information disclosure flaw caused by an operator precedence error in the getShopCartExpiryItems SQL filter. An authenticated attacker with any storefront account can access the GET /p/shopCart/expiryProdList endpoint to view other users' shoppi...

CVE-2026-108688

Eladmin versions through 2.7 are vulnerable to a missing authorization flaw in the LocalStorageController uploadPicture handler. This allows low-privileged authenticated users to bypass the storage:add permission. By sending POST requests with image-named files to /api/localStorage/pictures, an a...

CVE-2023-38811

The threat actor Earth Sirrush utilized the exploitation of CVE-2023-38811 as part of a multi-year spear-phishing espionage campaign targeting Ukrainian government, defense, border-security, and logistics organizations. Early operations involving this vulnerability delivered payloads such as LONE...

CVE-2026-104247

The VTCode software is affected by a parser gap where specific command flags can bypass security blocks. Specifically, the software auto-approved a find command after three consecutive confirmations, allowing the -exe$''c flag to slip past the -exec block. This vulnerability is associated with CV...

CVE-2026-108680

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability (CWE-862) affecting the POST /sys/api/sendTemplateAnnouncement endpoint. This flaw allows any authenticated user to send template notifications. A low-privileged attacker can exploit this by supplying forged ...

CVE-2026-108679

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization vulnerability in the SystemApiController component, specifically within the sendBusAnnouncement handler. This flaw allows any authenticated user to bypass permission checks by sending a POST request to /sys/api/sendBusA...

CVE-2026-108677

Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the GET /sys/api/getUserByName endpoint. This vulnerability allows low-privileged authenticated users to retrieve the stored password values of any user. Attackers can further decrypt the AES-CBC pro...

CVE-2026-108678

The JeecgBoot framework (versions through 3.9.5 ) contains a missing authorization vulnerability in the queryUserRoles handler of the SystemApiController . This flaw allows authenticated users to perform GET requests to the /sys/api/queryUserRoles endpoint using an arbitrary username. Consequentl...

CVE-2026-108676

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the SysAnnouncementController downLoadFiles handler. This vulnerability allows low-privileged authenticated users to bypass authorization checks by supplying a known announcement ID. An attack...