CVE-2026-56720

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-11733

A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device...

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Impact VolumeServer.FetchAndWriteNeedle fetches a caller-supplied remote endpoint and writes the response into a needle. Before 4.24 this RPC performed no authentication and no validation of the target, so anyone able to reach a volume server's gRPC port could coerce the server into issuing...

EUVD-2026-56236

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

CVE-2026-56721 CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

EUVD-2026-56232

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720

CVE-2026-56720 — CamaleonCMS

EUVD-2026-56221

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...

CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...

CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...

CVE-2026-11736 Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...

CVE-2026-11735

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-11738 Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2026-11738

CVE-2026-11738 describes an insufficient input validation vulnerability affecting certain NETGEAR Nighthawk routers (e.g., RAXE500, RS700, R7000). It allows authenticated administrators on the local network to tamper with router software and functionality, enabling unauthorized modification. The ...

CVE-2026-11734 Device administrator can interrupt the normal operation of some NETGEAR Nighthawk devices.

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...

EUVD-2026-56191

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...

EUVD-2026-56189

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...