CVE-2026-110124

FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Kerwincui

Products

Fastbee

CVE-2026-110120

yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Guchengwuyue

Products

Yshopmall

CVE-2026-110119

yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Guchengwuyue

Products

Yshopmall

CVE-2026-110115

Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Risesoft-y9

Products

Digital-infrastructure

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110103

bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Bbs-go Project

Products

Bbs-go

CVE-2026-110102

powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Romkatv

Products

Powerlevel10k

CVE-2026-110098

Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jorani

Products

Jorani

CVE-2026-109901

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109890

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109739

Privilege escalation in the WebExtensions component

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-109704

Privilege escalation in the Application Update component

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-109620

SourceCodester Online Reviewer System index.php prepare sql injection

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Online Reviewer System

CVE-2026-109195

Quay: repository auto-prune policy uuid idor in quay api

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Quay

CVE-2026-109167

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tduckcloud

Products

Tduck-survey-form

CVE-2026-108705

CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108700

1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108692

1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108680

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108675

JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot