CVE-2026-126314

Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Hrms

CVE-2026-126265

SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie

SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-53995

MLflow < 3.18.0 Path Traversal via Trace ID API

MLflow before 3.18.0 contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Lfprojects Mlflow

Products

Mlflow Mlflow

CVE-2026-123177

Dnf5: dnf5daemon-server: dnf5daemon-server: unauthenticated privileged cmdline package fetch/open via add_cmdline_packages

A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.

CVSS 3.1 · 8.4 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Hummingbird

CVE-2026-63174

Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63172

Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63165

Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-129139

paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

CVSS 4.0 · 8.8 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129143

paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint

paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Itwanger

Products

Paicoding

CVE-2026-129151

SurveyKing 1.13.2 Unauthenticated Survey Response Disclosure via Result Lookup

SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Surveyking

Products

Surveyking

CVE-2026-129153

SurveyKing 1.12.0 through 1.13.2 Authorization Bypass via Linked Survey linkSurveyId

SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Surveyking

Products

Surveyking

CVE-2026-129161

Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.

CVSS 4.0 · 9.1 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129167

SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 Path Traversal RCE via confluence-to-wiki

Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-63163

Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63162

Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63161

Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63160

Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63159

Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63158

Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63154

Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project