CVE-2026-13738

creationtimestamp| type| source ---|---|--- 2026-08-11 12:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/117076763027370907 2026-08-11 12:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msskvvzi5g22 2026-08-11 13:30:04+00:00| seen|...

CVE-2026-13716

creationtimestamp| type| source ---|---|--- 2026-08-11 07:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/117075701139213523 2026-08-11 07:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mss3szlkbn2n...

CVE-2026-44758

creationtimestamp| type| source ---|---|--- 2026-08-11 01:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msrhducgo52v 2026-08-11 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/117074285629016309 2026-08-11 01:30:32+00:00| seen|...

CVE-2026-72751

creationtimestamp| type| source ---|---|--- 2026-08-10 15:03:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4sfasrwwnf2px...

CVE-2026-71959

creationtimestamp| type| source ---|---|--- 2026-08-10 15:01:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2fohbmglkugmk...

CVE-2023-54385

Erroneously reserved under wrong year by automation defect; never assigned...

CVE-2026-66412

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

EUVD-2026-49063

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412

Leantime vulnerability CVE-2026-66412 affects all versions prior to 3.6.2. A broken access control flaw in the tickets.getMilestone JSON-RPC endpoint allows authenticated users to read milestone data from projects they aren’t assigned to by supplying arbitrary integer milestone IDs. Attackers can...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

PT-2026-64852

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3 Description Authenticated users can access milestone data from projects to which they are not assigned. This is possible by providing arbitrary integer milestone IDs to the 'tickets.getMilestone' JSON-RPC...

CVE-UNASSIGNED-2022-HIKVISION-MANAGEMENT-PLATFORM-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 10:00:36+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/98553c66-c0b0-453f-8325-37efb35aaa5b...

CVE-UNASSIGNED-2022-RUIJIE-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 10:00:32+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bc64bc47-5865-48a1-ab28-b41f86f52766...

CVE-UNASSIGNED-2020-SAMSUNG-WLAN-AP-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 09:59:18+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/38da8f85-bb02-4be1-85fb-378e980285c8...

CVE-UNASSIGNED-2020-ZYXEL-CPE-COMMAND-INJECTION-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 09:39:37+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7a5b5786-b418-4a38-b09b-03ba93dca08c...

CVE-2026-42547

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination wit...

CVE-2026-44776

Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can downloa...

CVE-2026-42547

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination wit...

CVE-2026-42547 IRIS Alerts Can be Falsely Attributed to Customers

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination wit...