https://vulnogram.org/ Most recent CVEs assigned by Turan Security (turansec). https://vulnogram.org/seaview/icons/turansec.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT https://vulnogram.org/CVE-2026-105107 https://vulnogram.org/CVE-2026-105107 Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only… High Wed, 14 Oct 2026 07:32:56 GMT https://vulnogram.org/CVE-2026-105106 https://vulnogram.org/CVE-2026-105106 Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::re… High Wed, 14 Oct 2026 07:23:03 GMT https://vulnogram.org/CVE-2026-105110 https://vulnogram.org/CVE-2026-105110 OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter. Critical Network Exploitable Thu, 08 Oct 2026 09:00:40 GMT https://vulnogram.org/CVE-2026-105105 https://vulnogram.org/CVE-2026-105105 CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inj… Critical Network Exploitable Sat, 03 Oct 2026 11:55:44 GMT https://vulnogram.org/CVE-2026-72610 https://vulnogram.org/CVE-2026-72610 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron la… Medium Tue, 11 Aug 2026 11:22:47 GMT https://vulnogram.org/CVE-2026-72609 https://vulnogram.org/CVE-2026-72609 An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parce… High Tue, 11 Aug 2026 11:22:44 GMT https://vulnogram.org/CVE-2026-72608 https://vulnogram.org/CVE-2026-72608 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image… Medium Tue, 11 Aug 2026 11:22:14 GMT https://vulnogram.org/CVE-2026-72607 https://vulnogram.org/CVE-2026-72607 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value… High Tue, 11 Aug 2026 11:22:12 GMT https://vulnogram.org/CVE-2026-72606 https://vulnogram.org/CVE-2026-72606 A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-suppl… High Tue, 11 Aug 2026 11:15:54 GMT https://vulnogram.org/CVE-2026-72605 https://vulnogram.org/CVE-2026-72605 A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenti… High Tue, 11 Aug 2026 11:15:37 GMT https://vulnogram.org/CVE-2026-72604 https://vulnogram.org/CVE-2026-72604 A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to… Medium Tue, 11 Aug 2026 11:15:25 GMT https://vulnogram.org/CVE-2026-72603 https://vulnogram.org/CVE-2026-72603 An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is wr… Critical Tue, 11 Aug 2026 11:15:11 GMT https://vulnogram.org/CVE-2026-72602 https://vulnogram.org/CVE-2026-72602 A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts a… High Tue, 11 Aug 2026 11:14:58 GMT https://vulnogram.org/CVE-2026-72601 https://vulnogram.org/CVE-2026-72601 A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authenticatio… High Tue, 11 Aug 2026 11:14:44 GMT https://vulnogram.org/CVE-2026-72600 https://vulnogram.org/CVE-2026-72600 A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, maki… High Tue, 11 Aug 2026 11:14:30 GMT https://vulnogram.org/CVE-2026-72599 https://vulnogram.org/CVE-2026-72599 An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can… Critical Tue, 11 Aug 2026 11:14:15 GMT https://vulnogram.org/CVE-2026-72598 https://vulnogram.org/CVE-2026-72598 A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook regi… Medium Tue, 11 Aug 2026 11:14:02 GMT https://vulnogram.org/CVE-2026-72597 https://vulnogram.org/CVE-2026-72597 A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-sup… Medium Tue, 11 Aug 2026 11:13:51 GMT https://vulnogram.org/CVE-2026-72596 https://vulnogram.org/CVE-2026-72596 A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible() cascade is missing the branch that handles the combined isAuthor and isDestr… High Tue, 11 Aug 2026 11:13:39 GMT https://vulnogram.org/CVE-2026-72595 https://vulnogram.org/CVE-2026-72595 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize() method and perfo… High Tue, 11 Aug 2026 11:13:28 GMT https://vulnogram.org/CVE-2026-72563 https://vulnogram.org/CVE-2026-72563 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams via the LeadsController@update endpoint. The endpoint performs no authorization check, and t… High Tue, 11 Aug 2026 11:13:15 GMT https://vulnogram.org/CVE-2026-72562 https://vulnogram.org/CVE-2026-72562 An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE c… High Tue, 11 Aug 2026 11:13:02 GMT https://vulnogram.org/CVE-2026-72561 https://vulnogram.org/CVE-2026-72561 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint pe… High Tue, 11 Aug 2026 11:12:48 GMT https://vulnogram.org/CVE-2026-72560 https://vulnogram.org/CVE-2026-72560 A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback ad… Medium Tue, 11 Aug 2026 11:12:38 GMT https://vulnogram.org/CVE-2026-72559 https://vulnogram.org/CVE-2026-72559 A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user w… Medium Tue, 11 Aug 2026 11:12:26 GMT https://vulnogram.org/CVE-2026-72558 https://vulnogram.org/CVE-2026-72558 An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attack… High Tue, 11 Aug 2026 11:12:15 GMT https://vulnogram.org/CVE-2026-72557 https://vulnogram.org/CVE-2026-72557 An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The allowed_uploads configuration defaults to wildcard (*) and uploaded fi… High Tue, 11 Aug 2026 11:11:53 GMT https://vulnogram.org/CVE-2026-72556 https://vulnogram.org/CVE-2026-72556 A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\U… High Tue, 11 Aug 2026 11:11:40 GMT https://vulnogram.org/CVE-2026-72555 https://vulnogram.org/CVE-2026-72555 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default… High Tue, 11 Aug 2026 11:11:27 GMT https://vulnogram.org/CVE-2026-72554 https://vulnogram.org/CVE-2026-72554 A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested tic… Medium Tue, 11 Aug 2026 11:11:15 GMT https://vulnogram.org/CVE-2026-72553 https://vulnogram.org/CVE-2026-72553 A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped… Medium Tue, 11 Aug 2026 11:11:01 GMT https://vulnogram.org/CVE-2026-72552 https://vulnogram.org/CVE-2026-72552 A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller… High Tue, 11 Aug 2026 11:10:50 GMT https://vulnogram.org/CVE-2026-72551 https://vulnogram.org/CVE-2026-72551 A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively i… High Tue, 11 Aug 2026 11:10:35 GMT https://vulnogram.org/CVE-2026-72550 https://vulnogram.org/CVE-2026-72550 An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS que… Critical Tue, 11 Aug 2026 11:10:22 GMT https://vulnogram.org/CVE-2026-72549 https://vulnogram.org/CVE-2026-72549 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs n… Medium Tue, 11 Aug 2026 11:10:11 GMT https://vulnogram.org/CVE-2026-72548 https://vulnogram.org/CVE-2026-72548 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and… High Tue, 11 Aug 2026 11:09:58 GMT https://vulnogram.org/CVE-2026-72547 https://vulnogram.org/CVE-2026-72547 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads th… High Tue, 11 Aug 2026 11:09:44 GMT https://vulnogram.org/CVE-2026-72546 https://vulnogram.org/CVE-2026-72546 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint lo… High Tue, 11 Aug 2026 11:09:30 GMT https://vulnogram.org/CVE-2026-72545 https://vulnogram.org/CVE-2026-72545 An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication o… High Tue, 11 Aug 2026 11:09:17 GMT https://vulnogram.org/CVE-2026-72544 https://vulnogram.org/CVE-2026-72544 An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP addre… High Tue, 11 Aug 2026 11:09:00 GMT https://vulnogram.org/CVE-2026-72543 https://vulnogram.org/CVE-2026-72543 An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and perf… High Tue, 11 Aug 2026 11:08:45 GMT https://vulnogram.org/CVE-2026-72542 https://vulnogram.org/CVE-2026-72542 A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authori… Medium Tue, 11 Aug 2026 11:08:33 GMT https://vulnogram.org/CVE-2026-72541 https://vulnogram.org/CVE-2026-72541 A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission che… Medium Tue, 11 Aug 2026 11:08:18 GMT https://vulnogram.org/CVE-2026-72539 https://vulnogram.org/CVE-2026-72539 An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL… Medium Tue, 11 Aug 2026 11:07:47 GMT https://vulnogram.org/CVE-2026-72538 https://vulnogram.org/CVE-2026-72538 An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, ena… High Tue, 11 Aug 2026 11:07:35 GMT https://vulnogram.org/CVE-2026-72537 https://vulnogram.org/CVE-2026-72537 A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an exist… High Tue, 11 Aug 2026 11:07:22 GMT https://vulnogram.org/CVE-2026-72536 https://vulnogram.org/CVE-2026-72536 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authoriza… High Tue, 11 Aug 2026 11:07:07 GMT https://vulnogram.org/CVE-2026-72535 https://vulnogram.org/CVE-2026-72535 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authenticat… High Tue, 11 Aug 2026 11:06:55 GMT https://vulnogram.org/CVE-2026-72534 https://vulnogram.org/CVE-2026-72534 A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator gro… High Tue, 11 Aug 2026 11:06:44 GMT https://vulnogram.org/CVE-2026-72533 https://vulnogram.org/CVE-2026-72533 An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoin… High Tue, 11 Aug 2026 11:06:33 GMT