Threat database

CVE-2026-103502 is an improper certificate validation vulnerability in the hexpm hex_core library affecting versions from 0.1.0 up to but not including 0.20.0. The issue arises because hex_core's default HTTP adapter on Erlang/OTP 24 and OTP 25 (when the OS CA certificates cannot be loaded) does not verify server certificates properly, allowing an attacker who can intercept HTTPS connections to impersonate hex.pm or related repositories. The vulnerability stems from fallback behavior that disables certificate verification without clear documentation or warnings. hex_core 0.11.0 introduced secure SSL defaults for OTP 25+, but earlier versions and certain OTP configurations remain vulnerable. The CVSS 4.0 score is 5.9 (medium severity).

CVE-2026-108890 is a medium severity vulnerability in BlackBeltTechnology pi-agent-dashboard up to version 0.8.0. It involves improper authorization in the terminalManager.spawn function within the Terminal Handler component, caused by manipulation of the cwd argument. The vulnerability can be exploited remotely and a public exploit disclosure exists. The vendor responded promptly and released a fixed version.

A critical vulnerability (CVE-2026-85097) in the Bricksforge WordPress plugin allows unauthenticated attackers to upload arbitrary files and execute malicious code, potentially taking full control of affected WordPress websites. The flaw affects versions 3.1.8.9 and earlier and was patched in version 3.1.8.10. Exploitation attempts have been observed in the wild since October 7, 2026, involving automated attacks from multiple IP addresses. Bricksforge is a commercial add-on used by approximately 6,000 websites. The vulnerability has a CVSS score of 9.8, indicating critical severity.

jshERP versions up to 3.6 have a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data without proper role checks. This includes creating settlement accounts, products with initial stock, departments, and dictionary entries via specific POST endpoints.

jshERP versions up to 3.6 have an information disclosure vulnerability allowing authenticated users with low privileges to access sensitive platform-wide configuration secrets. This occurs via the getInfoByKey handler in the PlatformConfigController, which does not properly restrict access to certain keys. While keys like aliOss and weixin are blocked, others such as email_auth_code and activation_code can be retrieved, exposing SMTP authorization codes and activation secrets.

jshERP versions up to 3.6 have a mass assignment vulnerability in the UserController update handler. Authenticated users can overwrite protected fields such as tenant_id and password by sending a crafted PUT request. This allows attackers to switch tenants on next login or change other users' password hashes, potentially leading to account takeover.

jshERP versions up to 3.6 have a missing authorization vulnerability in the UserController updateUser handler. This flaw allows authenticated users with low privileges to assign arbitrary roles, including tenant administrator roles, to themselves or other users. This can lead to privilege escalation or unauthorized role reassignment.

jshERP versions up to 3.6 have an improper authorization vulnerability that allows low-privilege authenticated users to access settlement account ledgers beyond their permitted scope by manipulating the accountId parameter in a specific API call. This enables unauthorized viewing of sensitive financial details such as bill numbers, counterparties, amounts, and remarks within the tenant.

jshERP versions up to 3.6 have an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by manipulating the status parameter in a specific POST request. This bypasses audit permission checks and multi-level approval workflows, enabling the creation of audited bills that impact stock and reporting.

jshERP versions up to 3.6 have an incorrect authorization vulnerability in the GET /supplier/exportExcel endpoint. Authenticated users with restricted data scope can bypass role-based restrictions and export all supplier, customer, and member records. This exposes sensitive information such as contacts, phone numbers, tax numbers, bank accounts, and balances.

jshERP versions up to 3.6 contain an authorization bypass vulnerability that allows authenticated users with limited access to personal or department data to view other users' purchase, sales, and inventory bills. This occurs when an attacker includes purchaseStatus=0 in a search request, causing the service to ignore creator-based filtering and expose data across the tenant.

jshERP versions up to 3.6 have an authorization bypass vulnerability that allows authenticated users to access data from warehouses they are not assigned to by manipulating depotId or depotIds parameters. This bypass occurs even when warehouse restrictions are enabled, exposing sensitive stock and sales data.

jshERP versions up to 3.6 have a missing authorization vulnerability in the LogController. This flaw allows any authenticated user, including low-privilege users, to access the tenant's operation audit logs by sending GET requests to /log/list or /log/info. The exposed information includes other users' login names, client IP addresses, and actions.

jshERP versions up to 3.6 have a missing authorization vulnerability in the LogController. This flaw allows any authenticated user, including low-privilege users, to create, modify, or delete audit log entries via specific endpoints. Attackers can fabricate log entries, alter user and IP information, or erase logs to conceal their activities.

MoguBlog versions up to 6.2 contain a broken access control vulnerability that allows authenticated administrators to move or rename files belonging to other administrators on the network disk. This occurs because certain POST endpoints do not verify the admin_uid before updating file or folder locations. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.

MoguBlog versions up to 6.2 contain an insecure direct object reference vulnerability that allows authenticated administrators to access other administrators' network-disk files. The vulnerability exists because the endpoint POST /networkDisk/getFileList filters files by status, file type, or filePath but does not restrict access by administrator user ID, enabling unauthorized file listing and download URL retrieval.

MoguBlog versions up to and including 6.2 have an information disclosure vulnerability that allows low-privileged front-end users to access sensitive system credentials. By using the getSystemConfig endpoint with a normal reader session token, attackers can retrieve unfiltered configuration data, exposing secret keys for Qiniu and MinIO as well as SMTP mailbox passwords. This vulnerability has a high severity rating with a CVSS score of 7.1.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the invoice approval API endpoint. Authenticated back-office users can approve or reject invoices without proper authorization checks due to missing @PreAuthorize annotations and commented-out approver validations. This allows bypassing the intended invoice approval workflow.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the back-office API endpoint POST /admin-api/crm/contract-receivables/check. This flaw allows any authenticated back-office user to approve or reject receivables records without proper permission checks, enabling unauthorized approval actions and forgery of approval logs.