8163 matches found
PT-2026-89405
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, AppServicesPredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...
CVE-2026-88894: Incorrect Authorization
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...
MAL-2026-16109 Malicious code in @auction-fe/ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0383eb0003b48f9a03fefc5a97f9a4b4a2c7756fa1cbced8995bb05838ff404f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @auction-fe/ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0383eb0003b48f9a03fefc5a97f9a4b4a2c7756fa1cbced8995bb05838ff404f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in gmgn-trading-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc,...
MAL-2026-16094 Malicious code in gmgn-trading-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3 postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under /.ssh, /.netrc,...
CVE-2026-86773
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...
CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...
CVE-2026-86773
Snipe-IT through version 8.6.3 suffers from broken object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints, as well as the storeModel endpoint for Predefined Kits . The root cause is that the existing check authorizes only the parent Predefine...
CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...
EUVD-2026-74950
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...
CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...
PT-2026-89042
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...
CVE-2026-79696: Incomplete List of Disallowed Inputs
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...
ROOT-OS-DEBIAN-11-CVE-2026-13757 CVE-2026-13757 in p11-kit - Patched by Root
Root has patched CVE-2026-13757 in the p11-kit package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-18938 CVE-2026-18938 in p11-kit - Patched by Root
Root has patched CVE-2026-18938 in the p11-kit package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-13757 CVE-2026-13757 in p11-kit - Patched by Root
Root has patched CVE-2026-13757 in the p11-kit package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-18938 CVE-2026-18938 in p11-kit - Patched by Root
Root has patched CVE-2026-18938 in the p11-kit package for Root:Debian:13. Multiple fixed versions available...