Threat Intelligence Database

CVE-2026-55176 is a critical authorization vulnerability in Soft Machine versions 0.2.247 and earlier. The issue arises because two authentication helper functions accept a global shared secret as a bearer token without verifying workspace ownership. This allows any tenant with access to the shared secret to authenticate to other tenants' workspace APIs, enabling cross-workspace read, write, and destructive operations. No patches are publicly known at the time of publication.

CVE-2026-46711 is a high-severity vulnerability in Soft Machine's workspace HTTP service versions 0.2.247 and earlier. The service listens on all interfaces (0.0.0.0:8080) and exposes several endpoints without any authentication or origin verification. This allows any host with network access to the workspace's TCP port 8080 to read arbitrary files and download entire project directories. Additionally, because all workspaces share a private network and resolve peer addresses via an unauthenticated internal DNS record, any other workspace within the same Fly app or organization can act as an unauthenticated attacker. This effectively breaks the trust boundary between workspace owners and other users. No patches are publicly known at the time of publication.

A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

MediumVulnerabilityUnited StatesIndiaUnited Kingdom+7#cve#cve-2026-4356