6496 matches found
EUVD-2026-96707
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to...
CVE-2026-108700
1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw (CWE-862) within the /field/source/business-title endpoint. Authenticated users can perform a POST request to this endpoint without the required CONTRACT_BUSINESS_TITLE_READ permission. Successful exploitati...
CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...
CVE-2026-108692 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...
EUVD-2026-96709
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...
CLSA-2026-1791677094 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.11.0-tuxcare.2...
CVE-2026-108700: Missing Authorization
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...
CVE-2026-108692: Missing Authorization
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...
CVE-2026-108701: Missing Authorization
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to...
CVE-2026-108702: Missing Authorization
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESSSETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe...
CLSA-2026-1791666638 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.2...
CLSA-2026-1791666532 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.7.3-tuxcare.2...
CLSA-2026-1791666413 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.10.2-tuxcare.2...
CLSA-2026-1791666312 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 1.12.0-tuxcare.2...
CVE-2026-96341
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3...
CVE-2026-96341 WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3...
CVE-2026-96341
The WPMU DEV Forminator WordPress plugin (versions up to and including 1.57.3 ) is vulnerable to an Incorrect Privilege Assignment flaw (CWE-266). This vulnerability allows for Privilege Escalation , potentially enabling an attacker to gain unauthorized elevated permissions within the application...
CVE-2026-102388
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3...
CVE-2026-102388 WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3...
CVE-2026-102388
The WPMU DEV Forminator WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions 1.57.3 and below . The root cause is the improper neutralization of input during web page generation , which allows an attacker to store and execute malicious scripts. Exploitation details are ...