CI4MS, a CodeIgniter 4-based CMS skeleton, had a critical improper access control vulnerability prior to version 0.31.0.0. The application did not revoke active user sessions immediately when an account was deactivated, allowing users with deactivated accounts to maintain access indefinitely until manual logout. This flaw arises because account state changes are only enforced during login, not for existing sessions, and there is no session expiration mechanism. The vulnerability breaks the intended access control policy and can lead to persistent unauthorized access. This issue has been fixed in version 0.31.0.
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deleted. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deleted accounts to retain indefinite access until the user manually logs out. This behavior breaks the intended access control policy and results in persistent unauthorized access. This issue has been patched in version 0.31.0.0.
A critical improper access control vulnerability (CWE-284) exists in the Reviactyl panel versions 26.2.0-beta.1 through before 26.2.0-beta.5. The flaw is in the OAuth authentication flow, where social accounts are automatically linked based solely on matching email addresses. An attacker controlling a social account with the victim's email can gain full access to the victim's panel account without needing the victim's password. This leads to a full account takeover without prior authentication.
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
CVE-2026-4947 is an improper access control vulnerability in Foxit Software Inc. 's na1.foxitesign.foxit.com affecting versions before 2026-03-26. It involves an insecure direct object reference (IDOR) in the signing invitation acceptance process, where insufficient authorization validation allowed attackers to manipulate object identifiers to access or modify unauthorized resources. This could lead to forged signatures, compromising document integrity and authenticity. The vulnerability has a high severity with a CVSS score of 7.1. No known exploits are reported in the wild.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !php_sapi_name() === 'cli' never evaluates to true due to how PHP resolves operator precedence. The ! (logical NOT) operator binds more tightly than === (strict comparison), causing the expression to always evaluate to false, which means the die() statement never executes. As a result, the script is accessible via HTTP without authentication and will delete files from the server's temp directory while also disclosing the temp directory contents in its response. At time of publication, there are no publicly available patches.
LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint `/api/agents/chat/stream/:streamId` does not verify that the requesting user owns the stream. Any authenticated user who obtains or guesses a valid stream ID can subscribe and read another user's real-time chat content, including messages, AI responses, and tool invocations. Version 0.8.2 patches the issue.
CVE-2026-33890 is a high-severity improper access control vulnerability in franklioxygen MyTube versions prior to 1.8.71. An unauthenticated attacker can register an arbitrary passkey via exposed endpoints without authentication and then use that passkey to gain full administrative access. This allows complete compromise of the application without needing any existing credentials. The issue is fixed in version 1.8.71.
CVE-2026-0748 is a medium severity vulnerability in the Drupal 7 Internationalization (i18n) module, specifically the i18n_node submodule. It allows users with both "Translate content" and "Administer content translations" permissions to bypass intended access controls and view unpublished node titles and IDs through the translation UI and its autocomplete widget. This affects versions 7.x-1.0 through 7.x-1.35 of the module. There are no known exploits in the wild and no patch information is provided in the available data.
HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to `StatusActive` after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through `/api/v1/user/password/token` and completing the reset via `/api/v1/user/password/reset`, a disabled user can reactivate their account and bypass administrator-imposed account disablement. Version 2.2.0 patches the issue.
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch.
CVE-2026-33309 is a critical path traversal vulnerability in langflow versions 1.2.0 through 1.8.1. It arises from an architectural flaw in the LocalStorageService where boundary checks are missing, allowing an authenticated attacker to bypass filename validation on the POST /api/v2/files/ endpoint. This enables arbitrary file write anywhere on the host system, potentially leading to remote code execution without user interaction. The vulnerability stems from a failed patch for a previous related issue (CVE-2025-68478) and is fixed in version 1.9.0.
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Versions 1.41.1 and 2.41.1 contain a patch.
CVE-2026-0898 is a critical arbitrary file-write vulnerability in Pegasystems Pega Robot Studio versions 22.1 and R25, specifically affecting the Pega Browser Extension used by developers automating Chrome and Edge. An attacker can exploit this flaw by tricking a developer into visiting a malicious website during interrogation mode, enabling unauthorized file writes on the developer's system. This vulnerability does not impact Robot Runtime users. The CVSS 4.0 score of 9 reflects the high impact on confidentiality, integrity, and availability, with no privileges required but user interaction needed. Although no known exploits are currently reported in the wild, the risk remains significant due to the potential for code execution or system compromise. Organizations using Pega Robot Studio for browser automation should prioritize patching once available and implement strict browsing policies during development. Countries with substantial use of Pega products and strong automation development sectors are at higher risk.
CVE-2026-33478 is a critical remote code execution vulnerability in WWBN AVideo versions up to 26.0. It involves a chain of flaws in the CloneSite plugin that allows unauthenticated attackers to access secret keys, dump the database including weakly hashed admin passwords, and ultimately execute arbitrary OS commands via an injection in the rsync command. The vulnerability requires no authentication or user interaction and affects confidentiality, integrity, and availability severely. A patch is available in commit c85d076375fab095a14170df7ddb27058134d38c. Organizations using AVideo should urgently update to a fixed version to prevent exploitation. The CVSS score is 10.0, reflecting the critical nature of this flaw.
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with GET /assets/*path, which only requires authentication, a publish-service visitor can cause the desktop kernel to copy any readable sensitive file and then read it via GET, leading to exfiltration of sensitive files. This issue has been fixed in version 3.6.1.
free5GC is an open source 5G core network.free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All deployments of free5GC using the NRF discovery service are affected. The `EncodeGroupId` function attempts to access array indices [0], [1], [2] without validating the length of the split data. When the parameter contains insufficient separator characters, the code panics with "index out of range". A remote attacker can cause the NRF service to panic and crash by sending a crafted HTTP GET request with a malformed `group-id-list` parameter. This results in complete denial of service for the NRF discovery service.free5GC NRF version 1.4.2 fixes the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the NRF API to trusted sources only.