Latest CVEs

CVE-2026-105813 - Ivanti UWM Insecure Storage of Sensitive Information
Published: November 10, 2026
CVE ID :CVE-2026-105813
Published : Nov. 10, 2026, 3:24 p.m. | 7 minutes ago
Description :Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.
Severity: 6.3 | MEDIUM

CVE-2026-111245 - Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests
Published: November 10, 2026
CVE ID :CVE-2026-111245
Published : Nov. 10, 2026, 3:24 p.m. | 8 minutes ago
Description :After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA

CVE-2026-111246 - Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server
Published: November 10, 2026
CVE ID :CVE-2026-111246
Published : Nov. 10, 2026, 3:23 p.m. | 9 minutes ago
Description :The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity: 0.0 | NA

CVE-2026-111247 - Apache TomEE: Privilege escalation via user name matching a role name
Published: November 10, 2026
CVE ID :CVE-2026-111247
Published : Nov. 10, 2026, 3:23 p.m. | 9 minutes ago
Description :When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA

CVE-2026-125759 - Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key
Published: November 10, 2026
CVE ID :CVE-2026-125759
Published : Nov. 10, 2026, 3:22 p.m. | 9 minutes ago
Description :Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.
Severity: 7.7 | HIGH

CVE-2026-125758 - Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET
Published: November 10, 2026
CVE ID :CVE-2026-125758
Published : Nov. 10, 2026, 3:22 p.m. | 9 minutes ago
Description :Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
Severity: 9.1 | CRITICAL

CVE-2026-125757 - mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer
Published: November 10, 2026
CVE ID :CVE-2026-125757
Published : Nov. 10, 2026, 3:22 p.m. | 9 minutes ago
Description :mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Severity: 9.4 | CRITICAL

CVE-2026-125756 - postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation
Published: November 10, 2026
CVE ID :CVE-2026-125756
Published : Nov. 10, 2026, 3:22 p.m. | 9 minutes ago
Description :postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.
Severity: 8.2 | HIGH

CVE-2026-125755 - Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser
Published: November 10, 2026
CVE ID :CVE-2026-125755
Published : Nov. 10, 2026, 3:22 p.m. | 9 minutes ago
Description :Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.
Severity: 8.3 | HIGH

CVE-2026-125754 - Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 IDOR via ExpenseReport Payment API
Published: November 10, 2026
CVE ID :CVE-2026-125754
Published : Nov. 10, 2026, 3:22 p.m. | 9 minutes ago
Description :Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.
Severity: 7.1 | HIGH

CVE-2026-125753 - ABP Framework before 10.6.2 and 10.7.0 Path Traversal via Blogging File Endpoints
Published: November 10, 2026
CVE ID :CVE-2026-125753
Published : Nov. 10, 2026, 3:22 p.m. | 9 minutes ago
Description :ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.
Severity: 8.2 | HIGH

CVE-2026-111248 - Apache TomEE: Authentication with the stored password digest in Tomcat user identity store
Published: November 10, 2026
CVE ID :CVE-2026-111248
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA

CVE-2026-125752 - Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus
Published: November 10, 2026
CVE ID :CVE-2026-125752
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.
Severity: 5.0 | MEDIUM

CVE-2026-125751 - Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById
Published: November 10, 2026
CVE ID :CVE-2026-125751
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID.
Severity: 3.1 | LOW

CVE-2026-125750 - Firekylin through 2.18.1 Improper Authorization via Admin REST API GET Actions
Published: November 10, 2026
CVE ID :CVE-2026-125750
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.
Severity: 7.1 | HIGH

CVE-2026-125749 - TaxHacker through 0.8.5 IDOR via Settings Server Actions userId
Published: November 10, 2026
CVE ID :CVE-2026-125749
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts.
Severity: 4.2 | MEDIUM

CVE-2026-125748 - Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation
Published: November 10, 2026
CVE ID :CVE-2026-125748
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.
Severity: 5.3 | MEDIUM

CVE-2026-125747 - ZenTao PMS through 22.7 IDOR via Build Module Mutation Methods
Published: November 10, 2026
CVE ID :CVE-2026-125747
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edit, or relink stories and bugs on builds in foreign or private projects.
Severity: 5.4 | MEDIUM

CVE-2026-111249 - Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network
Published: November 10, 2026
CVE ID :CVE-2026-111249
Published : Nov. 10, 2026, 3:22 p.m. | 10 minutes ago
Description :The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA

CVE-2026-111250 - Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server
Published: November 10, 2026
CVE ID :CVE-2026-111250
Published : Nov. 10, 2026, 3:21 p.m. | 11 minutes ago
Description :The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity: 0.0 | NA

CVE-2026-111251 - Apache TomEE: Unauthenticated server shutdown via the admin port
Published: November 10, 2026
CVE ID :CVE-2026-111251
Published : Nov. 10, 2026, 3:20 p.m. | 12 minutes ago
Description :The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA

CVE-2026-111256 - Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server
Published: November 10, 2026
CVE ID :CVE-2026-111256
Published : Nov. 10, 2026, 3:20 p.m. | 12 minutes ago
Description :When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Severity: 0.0 | NA

CVE-2026-111257 - Apache TomEE: Well-known administrative credentials created at startup
Published: November 10, 2026
CVE ID :CVE-2026-111257
Published : Nov. 10, 2026, 3:19 p.m. | 13 minutes ago
Description :With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA

CVE-2026-111258 - Apache TomEE: Security constraint bypass via request routing
Published: November 10, 2026
CVE ID :CVE-2026-111258
Published : Nov. 10, 2026, 3:19 p.m. | 13 minutes ago
Description :The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA

CVE-2026-111259 - Apache TomEE: Predictable HTTP session identifiers in embedded server
Published: November 10, 2026
CVE ID :CVE-2026-111259
Published : Nov. 10, 2026, 3:18 p.m. | 14 minutes ago
Description :The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Severity: 0.0 | NA