CVE-2026-66738

creationtimestamp| type| source ---|---|--- 2026-08-10 16:15:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/53mnn22alhix4 2026-08-10 17:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msql7pnmsx27 2026-08-10 23:01:49+00:00| seen|...

CVE-2026-72751

creationtimestamp| type| source ---|---|--- 2026-08-10 15:03:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4sfasrwwnf2px...

CVE-2026-71959

creationtimestamp| type| source ---|---|--- 2026-08-10 15:01:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2fohbmglkugmk...

CVE-2026-4793

creationtimestamp| type| source ---|---|--- 2026-08-10 13:20:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msq6w2kqjg2n 2026-08-13 08:45:48+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0988...

CVE-2026-59899

creationtimestamp| type| source ---|---|--- 2026-08-10 13:20:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msq6vheark2o 2026-08-13 08:46:23+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0991...

CVE-2026-66699

creationtimestamp| type| source ---|---|--- 2026-08-10 13:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msq6o746ds2i 2026-08-11 09:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mssbpvsqdj2l...

CVE-2023-54385

Erroneously reserved under wrong year by automation defect; never assigned...

CVE-2026-66412

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412

Leantime vulnerability CVE-2026-66412 affects all versions prior to 3.6.2. A broken access control flaw in the tickets.getMilestone JSON-RPC endpoint allows authenticated users to read milestone data from projects they aren’t assigned to by supplying arbitrary integer milestone IDs. Attackers can...

EUVD-2026-49063

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...

PT-2026-64852

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3 Description Authenticated users can access milestone data from projects to which they are not assigned. This is possible by providing arbitrary integer milestone IDs to the 'tickets.getMilestone' JSON-RPC...

CVE-UNASSIGNED-2022-HIKVISION-MANAGEMENT-PLATFORM-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 10:00:36+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/98553c66-c0b0-453f-8325-37efb35aaa5b...

CVE-UNASSIGNED-2022-RUIJIE-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 10:00:32+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bc64bc47-5865-48a1-ab28-b41f86f52766...

CVE-UNASSIGNED-2020-SAMSUNG-WLAN-AP-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 09:59:18+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/38da8f85-bb02-4be1-85fb-378e980285c8...

CVE-UNASSIGNED-2020-ZYXEL-CPE-COMMAND-INJECTION-RCE-01

creationtimestamp| type| source ---|---|--- 2026-06-30 09:39:37+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7a5b5786-b418-4a38-b09b-03ba93dca08c...

CVE-2026-42547

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination wit...

CVE-2026-44776

Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization. A low-privileged user who knows or guesses a chapterId, volumeId, or seriesId belonging to a library they are not assigned to can downloa...

CVE-2026-42547

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination wit...