Threat database

CVE-2026-111683 is a missing authorization vulnerability in Allegro Ralph versions up to 20260902.1. Authenticated staff users can bypass rack model permissions due to RalphPermission skipping checks for views without a queryset. This allows attackers to access and modify rack and server room data, including asset hostnames, serial numbers, and management IPs.

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

APIPark versions up to and including 1.9.7-beta have an authorization bypass vulnerability that allows authenticated team managers to access and manipulate other teams' services and applications by modifying the team ID parameter. This can lead to unauthorized reading, modification, or deletion of services and applications across teams.

Ekko Studio versions up to 0.7.36 have a missing authorization vulnerability that allows any authenticated user without super_admin privileges to list and clear server-wide login lockouts. This can be exploited by sending DELETE requests to the /api/auth/locked-ips endpoint without specifying an IP parameter, which disables the login rate limiter and facilitates password guessing attacks against super_admin accounts.

Antiword versions up to 0.37 contain a stack out-of-bounds read vulnerability in the functions vGet8PapInfo and vGet8ChrInfo within prop8.c. This occurs because FKP run counts and grpprl offsets are not properly bounded, allowing a crafted .doc file with malicious FKP pages to read beyond a 512-byte stack buffer. This can lead to application crashes or corrupted style parsing.

Antiword versions up to 0.37 contain a heap out-of-bounds read vulnerability in the vGet8LstInfo function within prop8.c. This flaw is due to an inverted bounds check on the PlcfLst record count, allowing a crafted Word 8 .doc file to specify an excessive number of LSTF records in a small buffer. This causes reads beyond the allocated heap memory, leading to process crashes.

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.

course-tencent-cloud versions up to 2.0.1 have a vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes. These codes are not invalidated or limited in attempts, enabling attackers who know a victim's phone or email to repeatedly try codes via password reset and verify login endpoints, potentially leading to account takeover.

Hello-hao Tbed through version 0 contains an authorization bypass vulnerability that allows any authenticated user to rename images belonging to other users via the /admin/setImgFileName endpoint. This flaw enables attackers to overwrite image display names with arbitrary text, potentially misleading viewers by attributing altered names to victims.

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

Zr.Admin.NET versions up to 3.8.2 contain an SQL injection vulnerability in the ToPage paging helper that allows authenticated users with system:user:list permission to manipulate the ORDER BY clause via the PagerInfo.Sort query parameter. This flaw enables injection of subqueries or CASE expressions through the GET /system/user/list endpoint, potentially exposing database contents including stored credentials.

AIHelms versions up to 0.1.25 contain a missing authorization vulnerability in the efficiency API endpoints. Authenticated users with low privileges can bypass permission checks to read and modify organization-wide AI spending data and reports. This vulnerability allows unauthorized access to sensitive financial information and modification of suggestion statuses.

REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.

Piranha CMS versions up to 12.2 have a missing authorization vulnerability in the Piranha.Manager LanguageApiController. This flaw allows any authenticated manager user to perform language management actions—listing, creating, editing, and deleting site languages—without requiring the specific granular permissions. Exploitation can lead to removal of languages and reassignment of sites to the default language, impacting localized content across the entire instance.

Safing Portmaster versions before 2.2.5 have a missing authorization vulnerability that allows unprivileged local users to trigger updates via a specific API endpoint without proper authentication. This flaw enables attackers to supply a malicious update URL, bypass version checks, and install older signed versions containing previously fixed vulnerabilities.

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.