user-security-stories

User Security Stories This repository contains a collection of user security stories and acceptance criteria. User Security Stories Security Acceptance Criteria Please fork and contribute additional security stories and acceptance criteria that you think will benefit the community. History The...

superpowers-evals

Superpowers Evals Laboratorio de evaluación comportamental para superpowers. Quorum impulsa CLIs reales de agentes de codificación Claude, Codex, Antigravity, Gemini, Kimi, OpenCode, Pi y Copilot a través de un agente de control de calidad Gauntlet y los califica según los criterios de aceptación...

FARE: Forensic Acceptance Region Estimation for Catching Bait-And-Switch Image Generators

Modern AI image generators are increasingly deployed as opaque APIs, where customers can query the deployed service, but cannot inspect model weights or architecture. This creates a practical challenge: a provider may pass governance certification with one generator and later silently switch to a...

CVE-2026-67404

RabbitMQ (messaging and streaming broker) is vulnerable to a security bypass in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 . The root cause is that ssl_options/1 falls back to [{verify, verify_none}] without warning when no CA bundle is available. If the OAuth2 plugin is active w...

CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssloptions/1 falls back to verify, verifynone with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker...

CVE-2026-67404

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssloptions/1 falls back to verify, verifynone with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker...

CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

CLEANSTART-2026-CT24188 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

Unchecked Return Value

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Unchecked Return Value in the store process. An attacker can cause acceptance records to be finalized without supporting evidence files by completing an acceptance while the...

Server-side Request Forgery (SSRF)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the employeenum field in the acceptance PDF generation process. An attacker can cause the server to make arbitrary HTTPS requests to...

CVE-2026-86747

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-86739

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-86743

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-86771

Snipe-IT versions before 8.7.0 are vulnerable to Server-Side Request Forgery (SSRF) through the employee_num field in the asset acceptance PDF generator. The root cause is a failure to HTML-escape this field before passing it to TCPDF's writeHTML() function, allowing an attacker with the users.ed...

CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...