CVE-2026-111644

Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

L429609201

Products

Misaka Danmu Server

CVE-2026-111648

BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Build-admin

Products

Buildadmin

CVE-2026-111649

Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint

Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rocboss

Products

Paopao-ce

CVE-2026-111650

ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hoshinosuzumi

Products

Chronoframe

CVE-2026-111653

53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

53ai

Products

53aihub

CVE-2026-111655

ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit

ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zoujingli

Products

Think-plugs-admin

CVE-2026-111656

ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zhimaai

Products

Chatwiki

CVE-2026-111659

Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wayn111

Products

Waynboot-mall

CVE-2026-111671

Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Data-infra

Products

Cube-studio

CVE-2026-111672

Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Data-infra

Products

Cube-studio

CVE-2026-111675

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Xiaochong0302

Products

Course-tencent-cloud

CVE-2026-111683

Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Allegro

Products

Ralph

CVE-2026-111693

DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Databufflabs

Products

Databuff

CVE-2026-111694

qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qiantongtech

Products

Qknow

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Shaiwz

Products

Data-platform-open

CVE-2026-111696

data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Shaiwz

Products

Data-platform-open

CVE-2026-111697

HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111698

HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111699

Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Niefy

Products

Wx-api

CVE-2026-111700

WebVella ERP through 1.8.8 SQL Injection via EQL Query API

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read unauthorized entities, including user and role tables.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Webvella

Products

Webvella-erp