CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scopelocationsfmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location...

CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scopelocationsfmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location...

CVE-2026-54329

Summary: CVE-2026-54329 affects Snipe-IT before 8.6.2, where the Accessories API can mass-assign the company_id field, enabling a low-privilege user in one company (with FMCS enabled) to create accessory records under another company. Root cause: API create path mass-assigns request parameters di...

CVE-2026-53653

creationtimestamp| type| source ---|---|--- 2026-07-10 18:20:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqcra4ilol2c 2026-07-10 22:51:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdadyx4fk27 2026-07-10 23:35:17+00:00| seen|...

CVE-2026-58492

creationtimestamp| type| source ---|---|--- 2026-07-10 17:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcpfumldx24 2026-07-10 23:13:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbkwnpvh2d 2026-07-10 23:13:07+00:00| seen|...

CVE-2026-1667

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-61431

creationtimestamp| type| source ---|---|--- 2026-07-10 16:57:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcmlhpqih2l 2026-07-10 20:18:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxtbl45i2f 2026-07-10 22:05:28+00:00| seen|...

CVE-2026-61450

creationtimestamp| type| source ---|---|--- 2026-07-10 16:47:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqclzktvii26 2026-07-10 20:16:59+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqcxq5tkwy25 2026-07-10 23:27:04+00:00| seen|...

CVE-2026-61441

creationtimestamp| type| source ---|---|--- 2026-07-10 16:32:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcl6piort2i 2026-07-10 22:21:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6omq2ei26 2026-07-10 23:26:14+00:00| seen|...

CVE-2026-1667

The CVE concerns the SEO Plugin by Squirrly SEO for WordPress (up to version 14.0.0) with a vulnerability in savePost() that allows unauthenticated users to create arbitrary posts and, if Advanced Custom Fields is installed, to inject stored XSS scripts. Root cause is a leak of an API token and i...

CVE-2026-1667 SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-61444

creationtimestamp| type| source ---|---|--- 2026-07-10 16:15:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqck7yabkh27 2026-07-10 16:46:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqclwzjjnb2f 2026-07-10 20:16:31+00:00| seen|...

CVE-2026-59796

creationtimestamp| type| source ---|---|--- 2026-07-10 16:12:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqck3iudxm2x 2026-07-10 20:22:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcy2mf6472z 2026-07-12 06:00:48+00:00| seen|...

CVE-2026-48043

creationtimestamp| type| source ---|---|--- 2026-07-10 15:58:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcjc5vizd2e...

CVE-2026-54469

creationtimestamp| type| source ---|---|--- 2026-07-10 15:30:16+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116896393517811948 2026-07-10 17:27:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcoasxcp327 2026-07-10 21:24:23+00:00| seen|...

GHSA-4VJ7-5MJ6-JM8M

creationtimestamp| type| source ---|---|--- 2026-07-10 15:11:59+00:00| seen| https://gist.github.com/alon710/6a1f370c6283107f299350100ca84db2...

CVE-2026-48138

creationtimestamp| type| source ---|---|--- 2026-07-10 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqceqewuyp2g...

CVE-2026-31267

creationtimestamp| type| source ---|---|--- 2026-07-10 14:07:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116896068760157808 2026-07-11 00:34:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg4zqogq2z...

EUVD-2026-42887

n8n before 1.123.24, 2.10.4, and 2.12.0 across its 1.x and 2.x branches contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions...

CVE-2026-56312 Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint

Capgo before 12.128.2 contains an improper validation vulnerability in the acceptinvitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn...