CVE-2026-112286 Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve...

CVE-2026-112286

Krayin CRM versions before 2.2.7 are vulnerable to an insecure direct object reference (IDOR) vulnerability within the QuoteController . This flaw allows scope-restricted authenticated users to bypass per-user data scope checks. By querying the quotes search and lead-products endpoints, an attack...

CLSA-2022-1657182150 Fix CVE(s): CVE-2022-2129, CVE-2022-2124, CVE-2022-2125, CVE-2022-2126, CVE-2022-1720

SECURITY UPDATE: Reading past end of line with "gf" in Visual block mode - debian/patches/CVE-2022-1720.patch: Do not include the NUL in the length - CVE-2022-1720 SECURITY UPDATE: Searching for quotes may go over the end of the line - debian/patches/CVE-2022-2124.patch: Check for running into th...