CVE-2026-48437

CVE-2026-48437 affects CAI Content Credentials and is due to Improper Certificate Validation, enabling a security feature bypass and unauthorized write access. Exploitation requires user interaction (victim visits a malicious URL or interacts with a compromised page). CVSS 3.1 base score 5.5 (Med...

CVE-2026-48437 CAI Content Credentials | Improper Certificate Validation (CWE-295)

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interactio...

EUVD-2026-56559

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interactio...

CVE-2026-48385 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-48385

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-48385

CVE-2026-48385 affects ColdFusion and is described as an Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability that could bypass security features and grant unauthorized write access. The issue can be triggered remotely (attack vector: NETWORK) wit...

EUVD-2026-56548

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this...

CVE-2026-21279 ColdFusion | Improper Input Validation (CWE-20)

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction...

EUVD-2026-56543

is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability...

CVE-2026-48376

is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability...

CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

CVE-2026-72547

CVE-2026-72547 affects Attendize (Attendize project) via the postImportAttendee endpoint. The flaw is an insecure direct object reference: the system loads the target event by ID without verifying ownership against the requesting organiser account, enabling any authenticated event organiser to bu...

PT-2026-70346

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An Improper Encoding or Escaping of Output issue allows a low-privileged attacker to bypass security features. This can lead to limited unauthorized write acces...

PT-2026-70782

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user...

PT-2026-70257

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback rout...

PT-2026-70348

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. This flaw allows a low-privileged attacker to bypass security features and...

PT-2026-70376

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in...

CVE-2026-72910

CVE-2026-72910 affects ERPNext prior to versions 15.112.0 and 16.22.0. The issue arises because the functions merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center (across ERPNext code paths: erpnext/accounts/doctype/account/account.py, erpnext/account...

EUVD-2026-54650

Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could have leveraged this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue...

CVE-2026-62323 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...