CVE-2026-19579

Affected software: Snipe-IT

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

EUVD-2026-56949

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-72557

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72557: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

PT-2026-70901

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancel by admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

PT-2026-70202

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784: Server-Side Request Forgery (SSRF)

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT...

PT-2026-70132

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0 Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads...

CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574 picocms Pico - Host Header Injection Enables Script Source Hijacking

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72574

The CVE-2026-72574 entry describes a host header injection in Pico CMS (Pico, up to version 2.1.4) where Pico::getBaseUrl() builds the base URL from unvalidated request headers (Host, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port) when base_url is unset. This allows an unauthenticated rem...

Ghostlink_lite

GHOSTLINK // Enterprise Cyber Command Center & Defensive Scann...

MAL-2026-13661 Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220 The package is advertised as a finance/payments adapter but on require reaches a staged loader. adapter.js reconstructs destination hostnames from...