Threat database

CVE-2026-111702 is an authorization bypass vulnerability in sugarforever's chat-ollama product, present through commit 96c3ce5. It allows remote attackers to access other users' private knowledge bases by supplying sequential IDs in API requests. Attackers can enumerate these IDs via GET /api/knowledgebases/{id} or the knowledgebaseId parameter in POST /api/models/chat, enabling them to read metadata and document content without authorization. The vulnerability has a high severity with a CVSS score of 8.7.

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 have a least privilege violation vulnerability. This flaw allows a low privileged local attacker to potentially elevate privileges and cause denial of service. The vulnerability is identified as CWE-272 and carries a high severity rating with a CVSS score of 7. The issue affects versions from initial releases up to but not including 6.14.54.0.

OtterMind Nubase versions up to 0.1.4 have a missing authentication vulnerability that allows unauthenticated attackers to access and delete private bucket objects. The endpoint /storage/v1/object/{bucketId}/{path} is treated as public for all HTTP methods, enabling attackers who know a tenant subdomain, bucket ID, and object path to download or delete objects without requiring an API key or JWT.

WebVella ERP versions up to and including 1.8.8 contain an SQL injection vulnerability in the EQL query API. Authenticated users can inject SQL via specially crafted single-quoted literals in the WHERE clause of EQL queries sent to the POST /api/v3/en_US/eql endpoint. This allows unauthorized reading of sensitive data such as user and role tables. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1.

Niefy wx-api versions up to 0.8.2 have an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by using a raw openid cookie. This enables attackers who know a victim's openid to access user information such as nickname, phone, unionid, and tags, and to modify fan tags via specific API endpoints.

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

CVE-2026-111695 is an authorization bypass vulnerability in shaiwz data-platform-open that allows authenticated workspace members to access and manipulate other workspaces' datasources by exploiting insecure direct object references via numeric IDs. Attackers can retrieve JDBC credentials, enumerate database schemas, and modify or delete datasources by sending crafted requests to specific API endpoints.

qKnow versions up to 2.4.3 have a missing authentication vulnerability allowing unauthenticated remote attackers to access certain workflow integration endpoints. Attackers can enumerate user phone numbers, roles, and department structure by sending POST requests to specific endpoints without authentication.

DataBuff ai-apm-web versions up to 0.1.10 contain a hard-coded default credentials vulnerability. This flaw allows unauthenticated attackers to gain administrator access by using the built-in admin/Databuff@123 credentials. Attackers can authenticate via a POST request to /webapi/api/v1/auth/login and obtain an administrator token, granting access to all protected API routes.

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

Simple Admin Core versions up to 1.8.7 contain a critical authentication bypass vulnerability due to a hard-coded cryptographic key. This flaw allows unauthenticated attackers to forge super administrator tokens by exploiting the hard-coded Auth.AccessSecret in the configuration file. By signing a JWT with this secret and a specific roleId claim, attackers can gain full administrative control over the system, including user, role, menu, API authority, configuration, and token management.

Exrick XBoot versions up to 3.3.4 have an authorization bypass vulnerability that allows authenticated users to access user records from any department by bypassing role-based data scope restrictions. This can expose usernames, real names, mobile numbers, emails, and status information via a crafted GET request.

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.

WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

IceCMS versions up to 4.1.5 contain an unauthenticated SQL injection vulnerability in the /WebResource/findresourcebynum endpoint. This flaw allows remote attackers to inject arbitrary SQL commands via the num path parameter, potentially extracting database contents through union-based or blind SQL injection techniques. The vulnerability does not require authentication and has a high severity rating.

Magistrala through version 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to manipulate device certificates belonging to other tenants. By supplying foreign serial numbers or entity IDs, attackers can view, issue, and revoke certificates across tenant boundaries, potentially disconnecting devices and minting unauthorized CA-signed certificates.