CVE-2026-110127

waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wayn111

Products

Waynboot-mall

CVE-2026-110122

PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pickmall

Products

Lilishop

CVE-2026-109774

Invalid pointer, undefined behavior in the DOM: Notifications component

Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-42515

Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cdac-noida

Products

E-sushrut Hmis E-sushrut Hospital Management Information System Hmis

CVE-2026-42516

Broken Access Control Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cdac-noida

Products

E-sushrut Hospital Management Information System Hmis

CVE-2026-77474

dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dicklesworthstone

Products

Destructive Command Guard

CVE-2026-111630

abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call ChatAppService.GetListAsync or SendMessageAsync with a victim's ConversationId GUID to read chat messages and inject messages into that conversation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Colinin

Products

Abp-next-admin

CVE-2026-111648

BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Build-admin

Products

Buildadmin

CVE-2026-111649

Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint

Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rocboss

Products

Paopao-ce

CVE-2026-111655

ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit

ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zoujingli

Products

Think-plugs-admin

CVE-2026-111656

ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zhimaai

Products

Chatwiki

CVE-2026-111671

Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Data-infra

Products

Cube-studio

CVE-2026-111672

Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Data-infra

Products

Cube-studio

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Shaiwz

Products

Data-platform-open

CVE-2026-111697

HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111698

HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111702

ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Sugarforever

Products

Chat-ollama

CVE-2026-111707

99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vastxie

Products

99ai

CVE-2026-111709

WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canove

Products

Whaticket-community

CVE-2026-111715

Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon