CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

CVE-2026-62945

TREK (a collaborative travel planner) prior to 3.1.3 contains an authorization bypass in its file upload, update, and link endpoints. The affected actions accept attacker-controlled reservation_id, place_id, and assignment_id values without invoking findForeignLinkTarget() to verify that the refe...

CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

PT-2026-79196

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.3 Description An authenticated user with file-edit permissions can disclose the existence and titles of reservations across private trip boundaries. The application fails to use the findForeignLinkTarget function to...

CVE-2021-0851

In the Android 12 security release notes, CVE-2021-0851 is listed under System with Type: ID and Severity: High. The provided connected document does not include a description of the root cause, affected component, or explicit remediation for this CVE. The notes indicate that Android 12 fixes iss...

CVE-2019-4223

IBM OpenPages GRC Platform is affected by an information-disclosure vulnerability tracked as CVE-2019-4223. The issue affects IBM OpenPages GRC Platform version 8.0 and allows disclosure of detailed error messages in WebApplication and API responses. Remediation provided by IBM fixes are availabl...