CVE-2026-12686

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

EUVD-2026-41860

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

CVE-2026-12686

CVE-2026-12686 affects Adiss’s Biloop: an authenticated user can manipulate a company ID in a POST to the backend, bypassing cross-tenant authorization and gaining access to other companies’ data (including billing) and potentially modifying third-party data. Root cause is inadequate verification...

CVE-2026-14792

creationtimestamp| type| source ---|---|--- 2026-07-06 08:36:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxophiybn27 2026-07-08 12:13:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq53s7wlqn2s...

CVE-2026-43867

The Apache Camel PQC Component is vulnerable to deserialization of untrusted data in the AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() method. The root cause is the use of a raw java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allow-list to process Base64-...

CVE-2026-43867

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads that metadata back from the...

CVE-2026-14794

creationtimestamp| type| source ---|---|--- 2026-07-06 08:18:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxnp5yvdk2u 2026-07-08 12:12:06+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mq53pb5hqk2s 2026-07-08 12:13:49+00:00| seen|...

CVE-2026-57647

creationtimestamp| type| source ---|---|--- 2026-07-06 08:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxnjpabra24...

CVE-2026-11855

creationtimestamp| type| source ---|---|--- 2026-07-06 08:06:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxn2h5nrc23 2026-07-07 00:00:17+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mpzcdreeve2x 2026-07-09 00:33:00+00:00| seen|...

CVE-2026-46590 Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

CVE-2026-46590 Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

Mirumee Saleor CSRF Protection Disabled

In Mirumee Saleor 2.7.0 fixed in 2.8.0, CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server...

PYSEC-2026-916 Mirumee Saleor CSRF Protection Disabled

In Mirumee Saleor 2.7.0 fixed in 2.8.0, CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server...

CVE-2026-11766

creationtimestamp| type| source ---|---|--- 2026-07-06 07:56:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxmie3xeq2u 2026-07-07 00:00:20+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mpzcdtrgfv2u 2026-07-09 00:32:39+00:00| seen|...

CVE-2026-57634

creationtimestamp| type| source ---|---|--- 2026-07-06 06:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxgt3oro42e...

CVE-2025-51060

creationtimestamp| type| source ---|---|--- 2026-07-06 06:09:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxgjun2i32i...

CVE-2025-50492

creationtimestamp| type| source ---|---|--- 2026-07-06 06:08:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxggl6bz52i...

CVE-2025-50489

creationtimestamp| type| source ---|---|--- 2026-07-06 06:07:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxgfu7fvp2y...

CVE-2026-14778

creationtimestamp| type| source ---|---|--- 2026-07-06 04:35:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxbbsa4hv26 2026-07-07 15:56:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq2xs6df7a2f...

CVE-2026-14790

creationtimestamp| type| source ---|---|--- 2026-07-06 04:30:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxaytrpcy2f 2026-07-08 02:52:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq44ft2qlc2f...