75347 matches found
CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allow...
CVE-2026-45576
creationtimestamp| type| source ---|---|--- 2026-07-16 18:46:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvhepsbd2n 2026-07-21 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr6car56u322...
Missing Authentication for Critical Function
Overview oncall is an Oncall is a calendar tool designed for scheduling and managing on-call shifts Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the plugin install endpoint when sending a POST request with hardcoded default stackid and orgid...
CVE-2026-45336
creationtimestamp| type| source ---|---|--- 2026-07-16 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrscyddbi2l 2026-07-16 19:25:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrxndfem52e...
CGA-8JRG-V7QH-PP6C
Bulletin has no description...
CVE-2026-8312
creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:32+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01 2026-07-21 08:50:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5gi7fnva2p 2026-07-25 10:51:50+00:00| seen|...
CVE-2026-59237 IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders
Authorization Bypass Through User-Controlled Key CWE-639 in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company tenant via a sequential numeric i...
CVE-2026-59237
Roskus Prospero Flow CRM prior to 5.5.3 is affected by an IDOR (CWE-639) vulnerability in the Order and OrderItem REST API controllers. The issue arises because Order::find($id) / Item::find($id) are not scoped to the authenticated user’s company, enabling a remote, authenticated user to read, mo...
CVE-2026-59237 IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders
Authorization Bypass Through User-Controlled Key CWE-639 in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company tenant via a sequential numeric i...
EUVD-2026-44932
Authorization Bypass Through User-Controlled Key CWE-639 in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company tenant via a sequential numeric i...
MINI-22H6-CH34-FCJQ
Bulletin has no description...
MINI-V7H3-985V-3R77
Bulletin has no description...
MINI-3XW3-JR6G-PMWJ
Bulletin has no description...
MINI-38F4-RWV8-8W9V
Bulletin has no description...
MINI-3MMR-JF5R-X4MR
Bulletin has no description...
MINI-QJX6-WMMV-QGPP
Bulletin has no description...
MINI-9W43-MHQ5-74HM
Bulletin has no description...
MINI-HX45-7824-Q7CC
Bulletin has no description...