CVE-2026-111675

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Xiaochong0302

Products

Course-tencent-cloud

CVE-2026-111683

Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Allegro

Products

Ralph

CVE-2026-111693

DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Databufflabs

Products

Databuff

CVE-2026-111694

qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qiantongtech

Products

Qknow

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Shaiwz

Products

Data-platform-open

CVE-2026-111696

data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Shaiwz

Products

Data-platform-open

CVE-2026-111697

HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111698

HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111699

Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Niefy

Products

Wx-api

CVE-2026-111700

WebVella ERP through 1.8.8 SQL Injection via EQL Query API

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Webvella

Products

Webvella-erp

CVE-2026-111701

OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Ottermind

Products

Nubase

CVE-2026-111702

ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Sugarforever

Products

Chat-ollama

CVE-2026-111706

99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Vastxie

Products

99ai

CVE-2026-111707

99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vastxie

Products

99ai

CVE-2026-111708

WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Canove

Products

Whaticket-community

CVE-2026-111709

WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canove

Products

Whaticket-community

CVE-2026-111715

Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-111716

Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-111717

Arkon through 0.9.2 Missing Authorization via Skills Versions API

Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-111718

AipexBase through commit 690adb9 SQL Injection via /api/data/invoke

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security, reading other users' rows and tables.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kuafuai

Products

Aipexbase