CVE-2026-19579

Affected software: Snipe-IT

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

EUVD-2026-56949

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579: Authorization Bypass Through User-Controlled Key

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

PT-2026-70901

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancel by admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-14293

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

EUVD-2026-54994

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-14293

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

CVE-2026-15237

The MotoPress Hotel Booking (and Hotel Booking Lite ) WordPress plugin versions prior to 6.2.3 is vulnerable to an authentication bypass. The root cause is a lack of authorization or ownership checks on a REST endpoint used to create payment records. This flaw allows unauthenticated users to crea...

CVE-2026-17012

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (versions through 3.1.0 ) contains a payment bypass vulnerability. The flaw occurs because the plugin fails to verify if the PayPal account receiving a payment matches the merchant's configured account before marking a...

CVE-2026-14293: Improper Neutralization of Input During Web Page Generation

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-47127

Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556 go-git: Worktree operations may follow symlinks

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

GHSA-HH9P-6WH2-4MFC GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...