Priority MEDIUM 63
A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts.
Vulnerabilities
146 records
TI-2026-70685 CVE-2026-108705 · GHSA-9hfx-wfh9-xc9r
Missing authorization in CordysCRM data import lets users write records
Priority MEDIUM 57
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId.
TI-2026-70684 CVE-2026-108704 · GHSA-7v2x-2f52-8cpm
Authorization bypass in CordysCRM lets users add follow-up records
Priority MEDIUM 57
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id.
TI-2026-70683 CVE-2026-108703 · GHSA-74x7-h2r2-9j6r
CordysCRM Missing Authorization in /approval-resource/push Alters Approvals
Priority MEDIUM 57
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks.
TI-2026-70682 CVE-2026-108702 · GHSA-5crg-9pmg-qx98
Missing authorization in CordysCRM enables blind SSRF via webhook test
Priority MEDIUM 57
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs.
TI-2026-70681 CVE-2026-108701 · GHSA-p6fp-39mj-m4hm
Missing authorization in 1Panel-dev CordysCRM lets users modify contracts
Priority MEDIUM 57
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation.
TI-2026-70680 CVE-2026-108700 · GHSA-378v-v9jq-pgrf
Missing authorization in CordysCRM exposes invoicing entity data
Priority MEDIUM 64
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks.
TI-2026-70672 CVE-2026-108692 · GHSA-5qf6-4wf6-7g7c
Missing authorization in 1Panel-dev CordysCRM exposes other users' records
Priority MEDIUM 64
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks.
Priority LOW 28
MaxKB is an open-source AI assistant for enterprise.
TI-2026-55288 CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve
Priority LOW 28
MaxKB is an open-source AI assistant for enterprise.
TI-2026-54043 CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base
Priority MEDIUM 58
MaxKB is an open-source AI assistant for enterprise.
Priority HIGH 82
MaxKB is an open-source AI assistant for enterprise.
TI-2026-54048 CVE-2026-77522
Server-side request forgery in 1Panel-dev MaxKB
Priority MEDIUM 53
MaxKB is an open-source AI assistant for enterprise.
TI-2026-55287 CVE-2026-79917
MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation
Priority LOW 28
MaxKB is an open-source AI assistant for enterprise.
TI-2026-54042 CVE-2026-77516
MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path
Priority MEDIUM 58
MaxKB is an open-source AI assistant for enterprise.
Priority LOW 32
MaxKB is an open-source AI assistant for enterprise.
TI-2026-54050 CVE-2026-77525
MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
Priority MEDIUM 53
MaxKB is an open-source AI assistant for enterprise.
TI-2026-54044 CVE-2026-77518
MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows
Priority MEDIUM 56
MaxKB is an open-source AI assistant for enterprise.
TI-2026-55286 CVE-2026-79916
MaxKB AWS Bedrock model credential injection leads to remote code execution
Priority MEDIUM 40
MaxKB is an open-source AI assistant for enterprise.
TI-2026-54046 CVE-2026-77520
Missing authorization in 1Panel-dev MaxKB
Priority LOW 24
MaxKB is an open-source AI assistant for enterprise.
Priority MEDIUM 58
MaxKB is an open-source AI assistant for enterprise.
TI-2026-53725 CVE-2026-76899
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
Priority LOW 26
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment.
TI-2026-53728 CVE-2026-76902
CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`
Priority LOW 23
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment.
TI-2026-53726 CVE-2026-76900
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
Priority MEDIUM 63
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment.
TI-2026-53727 CVE-2026-76901
Authorization bypass in 1Panel-dev CordysCRM
Priority LOW 26
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment.