Gitlab -- vulnerabilities

Gitlab reports: Double Free issue in Regular Expression Parser impacts GitLab CE/EE Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE Missing Authorization issue in Duo AI job troubleshooting...

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

GHSA-4825-P4XM-PCF2 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with create permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. Th...

CVE-2026-76910

The open-source feature management platform Unleash (versions prior to 8.0.3 ) is vulnerable to an authorization bypass in the cloneFeatureToggle function and the POST /api/admin/projects/:projectId/features/:featureName/clone endpoint. The root cause is that the system validates permissions for ...

EUVD-2026-84861

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-77252

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, caller-supplied projectsfilter and spacesfilter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured...

CVE-2026-18462

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

CVE-2026-18462

The RTI Connext Professional (Core Libraries) software is vulnerable to an Integer Overflow or Wraparound and Improper Access Control vulnerability. This flaw allows for Shared Resource Manipulation and affects specific versions: 7.4.0 before 7.7.0.1 , 7.0.0 before 7.3.1.6 , and *6.1.0 before 6.1...

EUVD-2026-84617

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

CVE-2026-18462 Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

CVE-2026-18462 Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.

Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional Core Libraries allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1...

WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Manager versions = 2.9.19...

CVE-2026-95685

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...

EUVD-2026-84424

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...