13211 matches found
CVE-2026-86762
Snipe-IT before 8.7.0 is vulnerable to an authentication bypass via its API middleware. The CheckUserIsActivated middleware is not applied to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke existing Passport personal access tokens . A deactivated account t...
CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...
CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...
CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...
PT-2026-89031
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...
EUVD-2026-67928
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads...
EUVD-2026-67929
multer vulnerable to file size limit bypass via async fileFilter race condition...
EUVD-2026-67720
morgan vulnerable to Log Forging via unescaped Unicode line separators...
EUVD-2026-70213
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base...
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Summary Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observe...
GHSA-376H-93R7-7G6F Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Summary Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observe...
CLSA-2026-1788867095 TuxCare security update for http-proxy-middleware (1 CVE)
TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.19.1-tuxcare.3...
PT-2026-96872
TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.19.1-tuxcare.3...
CLSA-2026-1788806634 TuxCare security update for http-proxy-middleware (1 CVE)
TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.3-tuxcare.2...
CLSA-2026-1788806602 TuxCare security update for http-proxy-middleware (1 CVE)
TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.18.0-tuxcare.2...
CLSA-2026-1788806507 TuxCare security update for http-proxy-middleware (1 CVE)
TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.2...
CVE-2026-20510
In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11134622; Issue ID: MSV-8894...
EUVD-2026-72203
In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11134622; Issue ID: MSV-8894...
CVE-2026-20510
In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11134622; Issue ID: MSV-8894...
CVE-2026-20510
In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11134622; Issue ID: MSV-8894...