CVE-2026-92119None▾ SunlitREST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
REST API Mass Assignment vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.21.0.
Users are recommended to upgrade to version 1.22.0, which fixes the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108948Medium· 5.4A vulnerability has been found in code-projects Online Reviewer System 1.0
CVE-2026-78416NoneCraft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling
CVE-2026-109186High· 8.8jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password
CVE-2026-108740High· 8.3GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests
CVE-2025-7104High· 7.5A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions
CVE-2021-23450High· 7.5All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.