4275 matches found
PT-2026-60477
Authorization Bypass Through User-Controlled Key CWE-639 in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company tenant via a sequential numeric i...
CGA-26RM-6QF5-258V
Bulletin has no description...
kintara-security-assessment
Kintara.gg — Full Security Assessment & Exploit Suite Date:...
MINI-9QRM-75X2-P58M
Bulletin has no description...
MINI-62R4-QP9M-4J2H
Bulletin has no description...
CVE-2026-57711
creationtimestamp| type| source ---|---|--- 2026-07-14 01:50:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql3rewijz2w 2026-07-16 08:16:56+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqsc4zohn2b...
PYSEC-2026-3310 Out of bounds write in grappler in Tensorflow
Impact The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. Patches We have patched the issue in GitHub commit...
Out of bounds write in grappler in Tensorflow
ImpactThe function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. PatchesWe have patched the issue in GitHub commit...
MINI-473H-XX9R-M469
Bulletin has no description...
MINI-5WQX-H4QM-5X4V
Bulletin has no description...
BIT-GITLAB-2026-8472 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to...
PT-2026-59607
Summary A Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...
PT-2026-59009
Impact Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...
PT-2026-59778
Impact The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. Patches We have patched the issue in GitHub commit...
MINI-9MWH-JC3F-HP9R
Bulletin has no description...
MINI-8QX7-X8VR-HP2H
Bulletin has no description...
MINI-JMVR-63CP-68MW
Bulletin has no description...
MINI-HRG8-47CF-V6WM
Bulletin has no description...
CVE-2026-15502 AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection
A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The manipulation of the argument itemnumber results in sql injection. The attack may be performed from remote. The vendor was contacte...
CVE-2026-15502 AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection
A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The manipulation of the argument itemnumber results in sql injection. The attack may be performed from remote. The vendor was contacte...