223 matches found
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
openclarity
OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...
CVE-2026-33818 vulnerabilities
Vulnerabilities for packages: blob-csi, pulumi-language-yaml, yunikorn-web, jaeger-operator, configmap-reload, mountpoint-s3-csi-driver, rekor, aws-otel-collector, bazelisk, flux-notification-controller, ghaudit, kubewatch, seaweedfs, dgraph, azurefile-csi, spiffe-helper, smokescreen,...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: blob-csi, pulumi-language-yaml, yunikorn-web, jaeger-operator, configmap-reload, mountpoint-s3-csi-driver, rekor, aws-otel-collector, bazelisk, flux-notification-controller, ghaudit, kubewatch, seaweedfs, dgraph, azurefile-csi, spiffe-helper, smokescreen,...
GO-2026-5972 vulnerabilities
Vulnerabilities for packages: blob-csi, pulumi-language-yaml, yunikorn-web, jaeger-operator, configmap-reload, mountpoint-s3-csi-driver, rekor, aws-otel-collector, bazelisk, flux-notification-controller, ghaudit, kubewatch, seaweedfs, dgraph, azurefile-csi, spiffe-helper, smokescreen,...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: blob-csi, pulumi-language-yaml, yunikorn-web, jaeger-operator, configmap-reload, mountpoint-s3-csi-driver, rekor, aws-otel-collector, bazelisk, flux-notification-controller, ghaudit, kubewatch, seaweedfs, dgraph, azurefile-csi, spiffe-helper, smokescreen,...
GO-2025-3367 vulnerabilities
Vulnerabilities for packages: kargo, melange, bom, kots, trivy, pulumi-language-yaml, wolfictl, src-fingerprint, gitsign, zarf, gptscript, tfsec, goreleaser, grafana-alloy, k9s, flux-source-controller, flux-kustomize-controller, argocd-image-updater, kaniko, pulumi,...
GO-2025-3368 vulnerabilities
Vulnerabilities for packages: kargo, melange, bom, kots, trivy, pulumi-language-yaml, wolfictl, src-fingerprint, gitsign, zarf, gptscript, tfsec, goreleaser, grafana-alloy, k9s, flux-source-controller, flux-kustomize-controller, argocd-image-updater, kaniko, pulumi,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: sops, local-path-provisioner, bom, redka, rancher-telemetry, amazon-cloudwatch-agent-operator, kapp, nri-f5, nri-postgresql, cass-operator, kyverno-policy-reporter-kyverno-plugin, dbmate, gcp-compute-persistent-disk-csi-driver, src-fingerprint, vale, kuberay-operator...
CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...
Authorization Bypass Through User-Controlled Key
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the POST /api/v1/kits/kitid/licenses endpoint. An attacker can gain unauthorized access to and manipulate license object...
CVE-2026-55479
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478
Snipe-IT (IT asset/license management) has a vulnerability in the Kits API. Before version 8.6.2, POST /api/v1/kits/{kit_id}/licenses validates the caller’s ability to edit kits but does not authorize access to the referenced license object. This allows a low-privilege user with predefined-kit pe...
CVE-2026-7686
A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected by this vulnerability is the function postMessage of the file premium.preload.js of the component Legacy Premium Activation. Performing a manipulation results in improper access controls. Remote exploitation of the...
CVE-2026-32100 swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes
Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...
CVE-2026-22645
The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components...
CVE-2026-22645
The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components...