CVE-2026-110902

WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Liquid Web / Stellarwp Wordpress-extensions

Products

Event Tickets Event Tickets

CVE-2026-12254

Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue

Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Netskope

Products

Netskope Client

CVE-2026-109441

LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ginlix-ai

Products

Langalpha

CVE-2026-109443

JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jd-opensource

Products

Joysafeter

CVE-2026-77937

Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Letta Letta-ai

Products

Letta Letta

CVE-2026-112240

Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Typo3 Fluid-form By Coding.ms

CVE-2026-112068

Insecure Direct Object Reference in extension "Analytics" (analytics)

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Analytics

CVE-2026-9589

Unblu Spark Authorization Bypass in Configuration Cascade Operations

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Unblu

Products

Spark

CVE-2026-91189

GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count. That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Threadx Guix

CVE-2026-113603

x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

X402-foundation

Products

X402

CVE-2026-9825

IBM Cyber Fraud Reachable Assertion

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Cyber Fraud

CVE-2026-114394

Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Trudesk Project

Products

Trudesk

CVE-2026-114389

Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Chamilo

Products

Chamilo Lms

CVE-2026-114060

SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-113598

Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Modoboa

Products

Modoboa

CVE-2026-113359

Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Baserow

Products

Baserow

CVE-2020-37288

Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vyperlang

Products

Vyper

CVE-2026-106576

ImageMagick: Denial of service possible when parsing an XMP profile.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-107208

ImageMagick: Denial of service with crafted XMP profile

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Imagemagick

Products

Imagemagick

CVE-2026-114395

Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Trudesk Project

Products

Trudesk