cervantes

Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location. By facilitating efficient data...

CVE-2026-115994

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...

CVE-2026-115998

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

EUVD-2026-109262

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-115998

An Insecure Direct Object Reference (IDOR) vulnerability exists in Cervantes version v1.3-beta . This flaw allows an authenticated attacker to access sensitive data from projects they do not own, including proof-of-concept details , credentials , and client information . Furthermore, the attacker...

CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-115993

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges...

CVE-2026-115994 BOLA Allows Cross-Project Target Tampering

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...

CVE-2026-115994

The software Cervantes version v1.3-beta is affected by a Broken Object Level Authorization (BOLA) vulnerability (CWE-639). This flaw allows an attacker to modify or delete targets belonging to other projects without proper authorization. Such actions could compromise the integrity of penetration...

EUVD-2026-109260

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...

CVE-2026-115994 BOLA Allows Cross-Project Target Tampering

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...

CVE-2026-115993 Stored XSS in the “Notes” field of project checklists

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges...

CVE-2026-115993 Stored XSS in the “Notes” field of project checklists

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges...

CVE-2026-115993

A Stored XSS vulnerability exists in the “Notes” field of project Checklists within Cervantes version v1.3-beta . This vulnerability (CWE-79) could allow an attacker to execute arbitrary code in another user's browser with elevated privileges. No specific exploit information or remediation detail...

EUVD-2026-109259

Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges...

CVE-2026-115975

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects...

CVE-2026-115975 Broken access control in JiraController

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects...

CVE-2026-115975 Broken access control in JiraController

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects...

CVE-2026-115975

A broken access control vulnerability exists in the JiraController component of Cervantes version v1.3-beta . This flaw allows an attacker to create, edit, or delete Jira tickets for vulnerabilities in projects other than their own. The vulnerability is associated with CWE-862 (Missing Authorizat...