Total
3323 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-33668 | 1 Zammad | 1 Zammad | 2026-09-16 | N/A | 9.1 CRITICAL |
| An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to. | |||||
| CVE-2026-91773 | 2026-09-16 | N/A | 4.3 MEDIUM | ||
| Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories. | |||||
| CVE-2026-17059 | 1 Redhat | 1 Build Of Keycloak | 2026-09-16 | N/A | 6.5 MEDIUM |
| A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access. | |||||
| CVE-2026-16105 | 1 Redhat | 1 Build Of Keycloak | 2026-09-16 | N/A | 4.9 MEDIUM |
| A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm. | |||||
| CVE-2026-15945 | 1 Redhat | 4 Build Of Keycloak, Data Grid, Jboss Enterprise Application Platform Expansion Pack and 1 more | 2026-09-16 | N/A | 4.3 MEDIUM |
| A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration. | |||||
| CVE-2026-87033 | 1 Tanium | 1 Comply | 2026-09-16 | N/A | 5.4 MEDIUM |
| Tanium addressed an improper access controls vulnerability in Comply. | |||||
| CVE-2026-87025 | 1 Tanium | 1 Comply | 2026-09-16 | N/A | 5.4 MEDIUM |
| Tanium addressed an improper access controls vulnerability in Comply. | |||||
| CVE-2026-87019 | 1 Tanium | 1 Comply | 2026-09-16 | N/A | 4.3 MEDIUM |
| Tanium addressed an improper access controls vulnerability in Comply. | |||||
| CVE-2026-87047 | 1 Tanium | 1 Comply | 2026-09-16 | N/A | 6.3 MEDIUM |
| Tanium addressed an improper access controls vulnerability in Comply. | |||||
| CVE-2026-90598 | 2026-09-16 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypass. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance. | |||||
| CVE-2026-90517 | 2026-09-16 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-87994 | 1 Openwebui | 1 Open Webui | 2026-09-16 | N/A | 4.3 MEDIUM |
| Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user authored the targeted message. A channel member could use the chat completions endpoint to replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. This issue is fixed in version 0.11.1. | |||||
| CVE-2026-87997 | 1 Openwebui | 1 Open Webui | 2026-09-16 | N/A | 4.3 MEDIUM |
| Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1. | |||||
| CVE-2026-91846 | 2026-09-16 | N/A | N/A | ||
| Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves those UUIDs into their underlying objects. Before this fix, the generic add() path could therefore persist a UUID for an Event or Galaxy Cluster that the caller could not normally read. The patch explicitly notes that this made collections a way to reference another organisation’s private data and had caused disclosure of organisation-only events in the beta collection view. The fix centralizes authorization in __assertCanUseElements(). Event UUIDs are validated through Event::fetchSimpleEvent() under the current user’s ACL, while Galaxy Cluster UUIDs are checked through GalaxyCluster::fetchGalaxyClusters(). The check is applied both to the CRUD add() path and to addElementToCollection(). Version affected: ≤2.5.45 | |||||
| CVE-2026-86174 | 2026-09-16 | N/A | 4.3 MEDIUM | ||
| Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint. | |||||
| CVE-2026-82290 | 2026-09-16 | N/A | 5.3 MEDIUM | ||
| Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation. | |||||
| CVE-2026-69189 | 2026-09-16 | N/A | 7.6 HIGH | ||
| Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0. | |||||
| CVE-2026-80434 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-16 | N/A | 7.4 HIGH |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference. | |||||
| CVE-2026-81210 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-16 | N/A | 7.7 HIGH |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match. | |||||
| CVE-2026-90534 | 1 Flowiseai | 1 Flowise | 2026-09-15 | N/A | 6.5 MEDIUM |
| Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace, unlike other credential read paths which are workspace-scoped. As a result, an authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace and cause Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4. | |||||