CVE-2026-55739

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user-hasCompany$model-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability...

PT-2026-60095

Summary The ExportController web routes for creating and editing export templates are gated only by the class-level create export permission, which is granted to ROLE TEAMLEAD by default. The corresponding API routes and UI button visibility correctly require the stricter create export template...

chartbrew 安全漏洞

Chartbrew is an open-source data visualization and dashboard-building tool developed by Chartbrew. Version 4.9.0 of Chartbrew contains a security vulnerability. This vulnerability arises from allowing authenticated users with access to a particular project to update or delete SharePolicy records...

CVE-2025-68353 net: vxlan: prevent NULL deref in vxlan_xmit_one

In the Linux kernel, the following vulnerability has been resolved: net: vxlan: prevent NULL deref in vxlanxmitone Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlanxmitone, e.g. if the iface is brought down. This can lead to the following NULL dereference: BUG: kernel NULL...

PT-2022-16851 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.4.8.2 Description: The issue is a result of improper API route checking, allowing modification of customers and creation of orders without App Permission. This affects Shopware, an open commerce platform based on...