Total
199 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-109186 | 2026-10-18 | N/A | 8.8 HIGH | ||
| jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover. | |||||
| CVE-2026-97858 | 2026-10-16 | N/A | 5.3 MEDIUM | ||
| An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID. | |||||
| CVE-2026-108740 | 2026-10-16 | N/A | 8.3 HIGH | ||
| GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access. | |||||
| CVE-2026-92119 | 2026-10-16 | N/A | 9.1 CRITICAL | ||
| REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue. | |||||
| CVE-2026-77470 | 2026-10-15 | N/A | N/A | ||
| Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1. | |||||
| CVE-2025-69691 | 1 Pfsense | 1 Pfsense | 2026-10-15 | N/A | 9.9 CRITICAL |
| Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code. | |||||
| CVE-2025-69690 | 1 Pfsense | 1 Pfsense | 2026-10-15 | N/A | 9.1 CRITICAL |
| Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code. | |||||
| CVE-2026-105863 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 9.4 CRITICAL |
| Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0. | |||||
| CVE-2026-106100 | 1 Payloadcms | 1 Payload | 2026-10-15 | N/A | 7.1 HIGH |
| Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20. | |||||
| CVE-2025-9315 | 2026-10-14 | N/A | N/A | ||
| An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted JSON payload to the device's registration endpoint /api/v1/devices/register, allowing the attacker to register unauthorized devices without authentication. Although exploiting this vulnerability has limited modification of data, there is no impact to the confidentiality and availability of the affected device, as well as no loss of confidentiality, integrity, and availability within any subsequent systems. | |||||
| CVE-2026-102780 | 1 Techfry | 1 Tf Content | 2026-10-14 | N/A | 9.8 CRITICAL |
| Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`. | |||||
| CVE-2026-108948 | 2026-10-13 | 5.5 MEDIUM | 5.4 MEDIUM | ||
| A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-14341 | 2026-10-12 | N/A | 8.3 HIGH | ||
| Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Excessive Allocation, Flooding. This issue affects DivvyDrive: from 4.8.2.19 before 4.8.3.2. | |||||
| CVE-2026-71504 | 2026-10-12 | N/A | 8.1 HIGH | ||
| Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply an arbitrary user account identifier and new password in the request body to overwrite credentials and immediately lock out the legitimate account holder. | |||||
| CVE-2025-61781 | 1 Citeum | 1 Opencti | 2026-10-12 | N/A | 7.1 HIGH |
| OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources. An attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue. | |||||
| CVE-2026-78416 | 2026-10-12 | N/A | N/A | ||
| Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user. | |||||
| CVE-2025-7104 | 1 Librechat | 1 Librechat | 2026-10-09 | N/A | 7.5 HIGH |
| A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators. | |||||
| CVE-2025-52656 | 1 Hcltech | 1 Dryice Myxalytics | 2026-10-08 | N/A | 7.6 HIGH |
| HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields. | |||||
| CVE-2026-47102 | 1 Litellm | 1 Litellm | 2026-10-08 | N/A | 8.8 HIGH |
| LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this vulnerability without chaining any additional flaw. | |||||
| CVE-2025-15602 | 1 Snipeitapp | 1 Snipe-it | 2026-10-08 | N/A | 8.8 HIGH |
| Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance. | |||||