EUVD-2026-102494

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group...

CVE-2026-111350

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group...

CVE-2026-111350

The Papermark application (versions through 0.22.0 ) is vulnerable to a missing authorization flaw in the data room viewer group API. Authenticated users can exploit this by providing a victim team's data room and group identifiers to perform unauthorized actions. Specifically, an attacker can se...

CVE-2026-111350 Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group...

CVE-2026-111350 Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group...

EUVD-2025-199178

Malicious code in @lessondesk/electron-group-api-client npm...

SUSE CVE-2025-2527

Mattermost versions 10.5.x = 10.5.2, 9.11.x = 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request...

PT-2026-20442

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel related to PCI endpoint sub-group creation. Asynchronous creation of sub-groups via delayed work could result in a NULL pointer dereference if the...

CVE-2022-40129

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker...

Design/Logic Flaw

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker...

CVE-2022-40129

Affected product: Foxit PDF Reader (v12.0.1.12430). Vulnerability: Use-after-free in the JavaScript engine triggered by crafted PDFs, specifically via Optional Content Group API, leading to arbitrary code execution. Exploitation may require user action or could occur if a malicious site is visite...

CVE-2022-40129

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker...

CVE-2022-40129: Use After Free

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker...

CVE-2021-28060

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

PT-2021-17733

Name of the Vulnerable Software and Affected Versions: Group Office version 6.4.196 Description: A Server-Side Request Forgery SSRF issue allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to "group/api/upload.php" API endpoint. Recommendations: For Group Offic...

CVE-2021-28060: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...