high · CVSS v3 8.3 · CVSS v4 8.7 · EPSS 0.00337

CVE-2026-77935

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenti…

Description

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

Scores

Severity
high
CVSS v2
8.7
CVSS v3
8.3
CVSS v4
8.7
EPSS
0.00337

← All CVEs

Related CVEs

high

CVE-2026-105453

IBM Sterling Connect Direct for Unix contains a vulnerability in privilege management that allows local attackers to escalate their access. This flaw affects versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6. It is critical for environments where this file transfer solution is deployed with local user access.

View analysis

high

CVE-2026-107366

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an authorization flaw in message endpoints that allows any authenticated user to manipulate other users' data. This vulnerability enables bulk deletion, content overwriting, and session hijacking without proper ownership verification.

View analysis

high

CVE-2026-109126

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances contain hard‑coded credentials that can be used by a physically proximate attacker to gain elevated privileges. This flaw allows local attackers to bypass authentication and potentially take full control of the appliance. The vulnerability is rated high severity with a CVSS v3 score of 8.8.

View analysis

high

CVE-2026-112373

H3C Magic NX15 devices running version NX15V100R017 contain a stack-based buffer overflow vulnerability in the /usr/bin/usrlist binary. This flaw allows for remote exploitation, posing a significant risk to network infrastructure integrity. The vulnerability has been publicly disclosed, increasing the likelihood of active scanning and exploitation attempts.

View analysis