Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-115334 (GCVE-0-2026-115334)

Vulnerability from nvd – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

Summary

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization\u0027s UUID can send a POST request to /app/switch_organization/ to access that tenant\u0027s data and billing configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:50.195Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/views/views.py#L326-L340"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-authorization-bypass-via-switch-organization-endpoint"
        }
      ],
      "title": "Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115334",
    "datePublished": "2026-10-22T10:57:50.195Z",
    "dateReserved": "2026-10-22T10:37:08.370Z",
    "dateUpdated": "2026-10-22T10:57:50.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115333 (GCVE-0-2026-115333)

Vulnerability from nvd – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Summary

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/go/…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:49.499Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-improper-authentication-via-event-ingestion-api-key-prefix"
        }
      ],
      "title": "Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115333",
    "datePublished": "2026-10-22T10:57:49.499Z",
    "dateReserved": "2026-10-22T10:37:08.228Z",
    "dateUpdated": "2026-10-22T10:57:49.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115332 (GCVE-0-2026-115332)

Vulnerability from nvd – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

Summary

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:48.791Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/serializers/model_serializers.py#L518-L534"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 SQL Injection via Subscription Filter Keys",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-subscription-filter-keys"
        }
      ],
      "title": "Lotus through 0.10.2 SQL Injection via Subscription Filter Keys",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115332",
    "datePublished": "2026-10-22T10:57:48.791Z",
    "dateReserved": "2026-10-22T10:37:08.092Z",
    "dateUpdated": "2026-10-22T10:57:48.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115331 (GCVE-0-2026-115331)

Vulnerability from nvd – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

Summary

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:48.115Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/counter_query_templates.py#L14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-property-names-and-filters"
        }
      ],
      "title": "Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115331",
    "datePublished": "2026-10-22T10:57:48.115Z",
    "dateReserved": "2026-10-22T10:37:07.956Z",
    "dateUpdated": "2026-10-22T10:57:48.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115330 (GCVE-0-2026-115330)

Vulnerability from nvd – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Summary

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:47.428Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics"
        }
      ],
      "title": "Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115330",
    "datePublished": "2026-10-22T10:57:47.428Z",
    "dateReserved": "2026-10-22T10:37:07.826Z",
    "dateUpdated": "2026-10-22T10:57:47.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115329 (GCVE-0-2026-115329)

Vulnerability from nvd – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet

Summary

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/uselotus/lotus/issues/799	issue-tracking
https://github.com/uselotus/lotus/pull/802	patchissue-tracking
https://github.com/uselotus/lotus/commit/1375d514…	patch
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

lighthousekeeper1212 (Lighthouse Research Project) leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lighthousekeeper1212 (Lighthouse Research Project)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization\u0027s subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant\u0027s billing."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:46.708Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/uselotus/lotus/issues/799"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/uselotus/lotus/pull/802"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/uselotus/lotus/commit/1375d5140795d72251c89f47200879b9bd1d6d96"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/api/views.py#L754"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-cross-organization-idor-via-subscriptionviewset"
        }
      ],
      "title": "Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115329",
    "datePublished": "2026-10-22T10:57:46.708Z",
    "dateReserved": "2026-10-22T10:37:07.682Z",
    "dateUpdated": "2026-10-22T10:57:46.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115334 (GCVE-0-2026-115334)

Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

Summary

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization\u0027s UUID can send a POST request to /app/switch_organization/ to access that tenant\u0027s data and billing configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:50.195Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/views/views.py#L326-L340"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-authorization-bypass-via-switch-organization-endpoint"
        }
      ],
      "title": "Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115334",
    "datePublished": "2026-10-22T10:57:50.195Z",
    "dateReserved": "2026-10-22T10:37:08.370Z",
    "dateUpdated": "2026-10-22T10:57:50.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115333 (GCVE-0-2026-115333)

Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Summary

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/go/…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:49.499Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-improper-authentication-via-event-ingestion-api-key-prefix"
        }
      ],
      "title": "Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115333",
    "datePublished": "2026-10-22T10:57:49.499Z",
    "dateReserved": "2026-10-22T10:37:08.228Z",
    "dateUpdated": "2026-10-22T10:57:49.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115332 (GCVE-0-2026-115332)

Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

Summary

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:48.791Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/serializers/model_serializers.py#L518-L534"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 SQL Injection via Subscription Filter Keys",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-subscription-filter-keys"
        }
      ],
      "title": "Lotus through 0.10.2 SQL Injection via Subscription Filter Keys",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115332",
    "datePublished": "2026-10-22T10:57:48.791Z",
    "dateReserved": "2026-10-22T10:37:08.092Z",
    "dateUpdated": "2026-10-22T10:57:48.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115331 (GCVE-0-2026-115331)

Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

Summary

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:48.115Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/counter_query_templates.py#L14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-property-names-and-filters"
        }
      ],
      "title": "Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115331",
    "datePublished": "2026-10-22T10:57:48.115Z",
    "dateReserved": "2026-10-22T10:37:07.956Z",
    "dateUpdated": "2026-10-22T10:57:48.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115330 (GCVE-0-2026-115330)

Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Summary

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

4 references

URL	Tags
https://hackmd.io/@leediay/BkUc3WL2Mx	technical-description
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:47.428Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics"
        }
      ],
      "title": "Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115330",
    "datePublished": "2026-10-22T10:57:47.428Z",
    "dateReserved": "2026-10-22T10:37:07.826Z",
    "dateUpdated": "2026-10-22T10:57:47.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115329 (GCVE-0-2026-115329)

Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57

Title

Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet

Summary

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6762 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/uselotus/lotus/issues/799	issue-tracking
https://github.com/uselotus/lotus/pull/802	patchissue-tracking
https://github.com/uselotus/lotus/commit/1375d514…	patch
https://github.com/uselotus/lotus/blob/0.10.2/bac…	technical-description
https://github.com/uselotus/lotus	product
https://www.vulncheck.com/advisories/lotus-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
uselotus	lotus	Affected: 0 , ≤ 0.10.2 (semver)

Date Public

2026-07-27 00:00

Credits

lighthousekeeper1212 (Lighthouse Research Project) leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/uselotus/lotus",
          "product": "lotus",
          "vendor": "uselotus",
          "versions": [
            {
              "lessThanOrEqual": "0.10.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lighthousekeeper1212 (Lighthouse Research Project)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-07-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization\u0027s subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant\u0027s billing."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T10:57:46.708Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/uselotus/lotus/issues/799"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/uselotus/lotus/pull/802"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/uselotus/lotus/commit/1375d5140795d72251c89f47200879b9bd1d6d96"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/api/views.py#L754"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/uselotus/lotus"
        },
        {
          "name": "VulnCheck Advisory: Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-cross-organization-idor-via-subscriptionviewset"
        }
      ],
      "title": "Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115329",
    "datePublished": "2026-10-22T10:57:46.708Z",
    "dateReserved": "2026-10-22T10:37:07.682Z",
    "dateUpdated": "2026-10-22T10:57:46.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

12 vulnerabilities found for lotus by uselotus

CVE-2026-115334 (GCVE-0-2026-115334)

CVE-2026-115333 (GCVE-0-2026-115333)

CVE-2026-115332 (GCVE-0-2026-115332)

CVE-2026-115331 (GCVE-0-2026-115331)

CVE-2026-115330 (GCVE-0-2026-115330)

CVE-2026-115329 (GCVE-0-2026-115329)

CVE-2026-115334 (GCVE-0-2026-115334)

CVE-2026-115333 (GCVE-0-2026-115333)

CVE-2026-115332 (GCVE-0-2026-115332)

CVE-2026-115331 (GCVE-0-2026-115331)

CVE-2026-115330 (GCVE-0-2026-115330)

CVE-2026-115329 (GCVE-0-2026-115329)