CVE-2026-115748

**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

• CWE-639

• https://lists.apache.org/thread.html/979n9lzg10vc7tdrrlgy4lh5yrsw8wsj
• https://mina.apache.org/vysper-project/
• https://www.openwall.com/lists/oss-security/2026/10/23/21

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115726Aider through 0.86.2 contains a command execution vulnerabil…7.8
• CVE-2026-115727AgenticSeek before commit 409840c contains a remote code exe…8.1
• CVE-2026-115728@hapi/content from 6.0.1 before 6.0.3 contains a regular exp…7.5
• CVE-2026-115729@pdfme/common from 5.5.10 before 6.2.6 contains a server-sid…6.8
• CVE-2026-11573Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNod…7.1
• CVE-2026-115730i18next-http-backend 4.0.2 contains an incomplete fix in int…3.1
• CVE-2026-115749hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 be…3.3
• CVE-2026-11575The PhonePe Payment Solutions WordPress plugin before 3.1.0 …7.5
• CVE-2026-115750mcp-from-openapi from 2.5.0 before 2.9.0 contains a credenti…3.7
• CVE-2026-115751Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains…3.7
• CVE-2026-115752Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a …4.2
• CVE-2026-115754serialize-javascript from 7.0.1 before 7.1.3 contains a cros…4.7