CVE-2026-82472

Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Documenso

Products

Documenso

CVE-2026-82470

Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jeremyevans

Products

Rodauth

CVE-2026-82466

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Jeremyevans

Products

Rodauth

CVE-2026-82465

pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Pac4j

Products

Pac4j

CVE-2026-82462

pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Pac4j

Products

Pac4j

CVE-2026-82461

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Pac4j

Products

Pac4j

CVE-2026-82460

Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Coderaiser

Products

Cloudcmd

CVE-2026-82454

Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Omnivore-app

Products

Omnivore

CVE-2026-82453

rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Iot-ecology

Products

Rust-iot-platform

CVE-2026-82450

BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Bookstackapp

Products

Bookstack

CVE-2026-82449

Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cockpit-hq

Products

Cockpit

CVE-2026-82448

Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Shinobi Systems

Products

Shinobi

CVE-2026-82421

itsourcecode Sales and Inventory System emp_edit.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Sales And Inventory System

CVE-2026-82306

StarRocks Query Detail Endpoint Returns Every User's Query History

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Starrocks

Products

Starrocks

CVE-2026-82291

HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Heyform

Products

Heyform

CVE-2026-82290

Chainlit Feedback Endpoints Missing Ownership Validation

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Chainlit

Products

Chainlit

CVE-2026-82287

Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Rybbit-io

Products

Rybbit

CVE-2026-82285

BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Dataelement

Products

Bisheng

CVE-2026-82282

Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Runatlantis

Products

Atlantis

CVE-2026-82280

Quivr Prompt Endpoints Missing Ownership Validation

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Quivr

Products

Quivr